The General Data Protection Regulation (GDPR) has been in effect since May 2018, yet many technology companies still struggle with compliance. The regulation is dense — 99 articles covering everything from consent requirements to data breach notifications — and the consequences of non-compliance are severe: fines up to 20 million euros or 4 percent of annual global revenue, whichever is higher. Meta was fined $1.3 billion in 2023. Amazon was fined $887 million in 2021.
But GDPR compliance does not have to be overwhelming. For most tech companies, compliance comes down to a manageable set of technical and organizational measures. This guide focuses on practical implementation — what to build, what to configure, and what policies to put in place.
Who Does GDPR Apply To?
GDPR applies to any organization that processes personal data of individuals in the European Economic Area (EEA), regardless of where the organization is located. If your website is accessible to EU residents and collects any personal data (including IP addresses, email addresses, and cookies), GDPR likely applies to you.
"Personal data" is broadly defined: any information that can identify an individual directly or indirectly. This includes obvious identifiers like names and email addresses, but also IP addresses, cookie identifiers, device fingerprints, and behavioral data that can be linked to an individual.
The Six Lawful Bases for Processing
GDPR requires a lawful basis for every processing activity. The most common bases for tech companies are consent (the individual has given clear, affirmative consent for a specific purpose), contract (processing is necessary to fulfill a contract with the individual), and legitimate interest (processing is necessary for your legitimate business interests, balanced against the individual's rights).
Consent must be freely given, specific, informed, and unambiguous. Pre-checked boxes, bundled consent (consenting to terms of service automatically consenting to marketing), and implied consent do not meet GDPR requirements. Consent must be as easy to withdraw as it is to give.
Technical Implementation: Data Mapping
The foundation of GDPR compliance is knowing what personal data you collect, where it is stored, how it flows through your systems, and who has access to it. Create a data map that documents every personal data field in your application, which systems store it, how long it is retained, who has access, and what the lawful basis for processing is.
This sounds tedious, and it is — but it is essential. You cannot protect data you do not know about, and you cannot respond to data subject requests if you do not know where personal data lives. Review your databases, log files, analytics tools, third-party services, backups, and email systems. Personal data often ends up in places you do not expect.
Implementing Data Subject Rights
GDPR grants individuals several rights regarding their personal data. You must provide mechanisms to fulfill these rights within 30 days of a request.
Right of Access: individuals can request a copy of all personal data you hold about them. Build an export function that generates a machine-readable file (JSON or CSV) containing all of a user's data across all your systems. Right of Rectification: individuals can request correction of inaccurate data. Your user profile editing features likely cover this, but verify that corrections propagate to all systems where the data is stored.
Right of Erasure ("right to be forgotten"): individuals can request deletion of their personal data. Implement a deletion workflow that removes or anonymizes the user's data from all systems, including backups. Some data may be exempt from deletion (data required for legal obligations, financial records), but you must justify each exemption.
Right to Data Portability: individuals can request their data in a structured, machine-readable format. Your export function should produce standard formats that the individual or another service provider can use.
Privacy by Design and by Default
GDPR requires that privacy is built into your systems from the ground up, not bolted on afterward. This means collecting only the data you actually need (data minimization), retaining data only as long as necessary (storage limitation), securing data with appropriate technical measures (encryption, access controls), and defaulting to the most privacy-protective settings (privacy by default).
Implement automatic data retention policies that delete or anonymize personal data after its purpose has been fulfilled. Default new user accounts to the most restrictive privacy settings. Encrypt personal data at rest and in transit. Implement access controls so only employees who need personal data for their role can access it.
Cookie Consent and Tracking
Cookie consent is the most visible aspect of GDPR compliance. Before placing any non-essential cookies (analytics, advertising, social media), you must obtain explicit consent. Essential cookies (session cookies, security tokens, preference cookies necessary for functionality) can be placed without consent.
Implement a cookie consent banner that clearly explains what cookies you use and why, does not use pre-checked boxes or deceptive patterns (dark patterns), allows granular consent (accept analytics but reject advertising), and remembers the user's choice so they are not asked repeatedly. The banner must not block access to the site's content — users must be able to use your site without accepting non-essential cookies.
Data Breach Notification
If a personal data breach occurs, you must notify your supervisory authority within 72 hours if the breach is likely to result in a risk to individuals' rights. If the breach is high-risk, you must also notify the affected individuals directly.
Prepare for this now, not during a breach. Create a breach response plan that defines who is responsible for breach assessment and notification, how to document the breach (what happened, what data was affected, how many individuals are impacted), templates for supervisory authority and individual notifications, and procedures for containing the breach and preventing recurrence.
Third-Party Data Processors
If you share personal data with third-party services (analytics tools, email providers, cloud hosting, payment processors), you need Data Processing Agreements (DPAs) with each one. Most major service providers (AWS, Google Cloud, Mailchimp, Stripe) have standard DPAs available. Review them to ensure they meet GDPR requirements and sign them.
For data transfers outside the EEA, ensure appropriate safeguards are in place. The EU-US Data Privacy Framework covers US companies that have self-certified. For other countries, Standard Contractual Clauses (SCCs) are the most common mechanism.
Ongoing Compliance
GDPR compliance is not a one-time project. Conduct annual reviews of your data processing activities. Update your privacy policy when processing changes. Train employees who handle personal data. Monitor regulatory guidance for updates and enforcement trends. Conduct Data Protection Impact Assessments (DPIAs) for new processing activities that involve high-risk data or profiling.
ZeonEdge helps technology companies implement GDPR-compliant data handling practices. Learn more about our compliance consulting services.
Emily Watson
Technical Writer and Developer Advocate who simplifies complex technology for everyday readers.