Handle EU personal data the right way
If your organization touches the personal data of people in the EU, GDPR applies — even if you're based entirely in the US. We help you map the data, put the right policies and safeguards in place, and build the processes the regulation expects.
What GDPR actually requires
The General Data Protection Regulation is the EU's data privacy law. It governs how organizations collect, store, use, and protect the personal data of people in the EU — and it applies based on whose data you handle, not where your office sits.
A few things sit at the center of it:
- Broad scope. It covers personal data of EU residents, and it reaches organizations worldwide that handle it.
- Data-subject rights. People can access, correct, and delete their data, and you have to respond on time.
- Security. Article 32 expects safeguards that match the risk.
Who needs GDPR
GDPR reaches further than most US organizations expect. You likely need to address it if you're:
- A US company serving EU residents — selling to, marketing to, or handling their data
- A global SaaS provider with users in the EU
- A team already running HIPAA or SOC 2 that now has European customers
How we guide you through it
GDPR is as much about process as paperwork, and we build both with you.
01
Data mapping
We trace what EU personal data you hold, where it lives, and how it moves.
02
Data-subject-request processes
We build the workflow to handle access, deletion, and correction requests properly and on time.
03
Policies
We write the privacy policies and documentation GDPR expects.
04
Security controls
We put the Article 32 safeguards in place to keep that data protected.
What you get
A typical GDPR engagement includes:
Data mapping
What EU data you hold, and where it flows.
Policies
Privacy policies and documentation built for your organization.
Records of processing
The documentation the regulation expects you to keep.
DSAR workflow
A real process for handling data-subject requests.
Training
So your team knows how to handle EU data day to day.
GDPR questions we hear a lot
See more QuestionsDoes GDPR apply if we're only in the US?
Yes, if you handle personal data of people in the EU. The regulation follows the person, not your headquarters.
What is a data-subject request?
It's a person's request to access, correct, or delete their data. You need a workflow that can do that on time, not an inbox that hopes someone notices.
Can this sit next to HIPAA or SOC 2?
Often, yes. Where the controls overlap, we don't make you run a second program from scratch.
Let's talk about where you stand
Whether you're starting from scratch or shoring up a program you already have, the first step is a straight conversation about your organization and your risk.