Home › GDPR: process EU residents' data lawfully
Regulation
GDPR: process EU residents' data lawfully
If your product has users in the EU or you process data for European customers, GDPR applies to you regardless of where the company is registered. We integrate GDPR requirements into the same control system as SOC 2 and ISO 27001.
What a GDPR project includes
- Data inventory and records of processing activities (Art. 30)
- Lawful bases, privacy policy, cookie notice
- Data processing agreements (DPA) with customers and sub-processors, standard contractual clauses (SCC) for EU→Ukraine transfers
- Procedures for data-subject rights (access, erasure, portability) and breach response (72 hours)
- Impact assessments (DPIA) for high-risk processing, DPO or EU representative where required
Link to SOC 2 and ISO 27001
The SOC 2 Privacy criteria and ISO 27001 controls (plus ISO 27701) already cover much of the technical and organisational measures GDPR requires. We add the legal layer — lawful bases, contracts, data-subject rights — and get a consistent system without contradictory documents. See SOC 2 and GDPR.
What you get
- Records of processing and data-flow map
- GDPR document set in English and Ukrainian
- DPAs and SCCs for your customers and vendors
- Data-subject rights and breach-notification procedures
- Team training
- Annual review
How the project runs
Processing audit1–2 weeks
Documents and contracts3–5 weeks
Procedure roll-out2–4 weeks
Training1 week
Frequently asked questions
Is there a GDPR certificate?
There is no single official GDPR certificate. Compliance is demonstrated through documentation, audits and optionally ISO 27701 certification.
Do we need an EU representative?
If a non-EU company regularly processes EU residents' data and has no establishment there — usually yes (Art. 27). We help assess and arrange it.