CevroGDPR compliance for companies handling EU and EEA data
EU General Data Protection Regulation (GDPR): an established law with an active enforcement record. Overseen by National data protection authority (varies by member state).
Key requirements at a glance
| Registration with the regulator | Not required |
|---|---|
| Data protection officer | Depends on thresholds or circumstances |
| Breach notification | Within 72 hours |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Fines up to €20 million or 4% of global annual turnover, whichever is higher.
What to know in practice
Also applies in Iceland, Liechtenstein and Norway through the EEA Agreement. The default framework across the EU/EEA. Each member state pairs it with its own implementing law and DPA (e.g. Germany's BDSG/BfDI, France's CNIL, Spain's LOPDGDD/AEPD).
Countries covered
Germany, France, Italy, Spain, Poland, Romania, Netherlands, Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, Greece, Hungary, Ireland, Latvia, Lithuania, Luxembourg, Malta, Portugal, Slovakia, Slovenia, Sweden, Iceland, Liechtenstein, Norway, New Caledonia, French Polynesia.
How Cevro helps
- Maps GDPR to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in the EU and EEA?
National data protection authority (varies by member state) oversees EU General Data Protection Regulation (GDPR).
Is breach notification mandatory under GDPR?
The law sets a 72-hour window for notifying the regulator of a personal data breach, so you need detection and an incident process that can meet it.
Does the EU and EEA restrict cross-border data transfers?
Yes. Moving personal data out of the EU and EEA is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under GDPR?
Only in some cases, usually depending on the scale or sensitivity of your processing. Confirm whether you cross the threshold.
What are the penalties for non-compliance in the EU and EEA?
Fines up to €20 million or 4% of global annual turnover, whichever is higher.