What GDPR is and why buyers ask for it
The General Data Protection Regulation (GDPR) is the European Union’s data protection law, in force since 2018, governing how organisations collect, use and protect the personal data of individuals in the EU. The UK GDPR places equivalent obligations on data relating to individuals in the UK. Crucially, both apply extraterritorially: a business based anywhere in the world must comply if it offers goods or services to, or monitors the behaviour of, people in the EU or UK.
For B2B vendors, GDPR has become a standard part of due diligence. Enterprise buyers include data protection clauses in their contracts and ask suppliers to evidence how they meet their obligations as a controller or processor. An honest, documented GDPR position removes a recurring blocker in procurement. GDPR readiness is part of the broader Cyber Security and privacy work ABS supports.
What a GDPR assessment covers
GDPR compliance is not a single certificate — it is an ongoing programme. An ABS readiness and gap assessment reviews your processing against the regulation’s core requirements, typically including:
- Lawful basis for each processing activity, and how consent is captured where relied upon
- Data subject rights — access, rectification, erasure, portability and objection
- Records of processing and data mapping (Article 30)
- Data protection by design and by default, and Data Protection Impact Assessments for higher-risk processing
- Breach detection and notification within the required 72-hour window
- International transfers and the safeguards used for them
- Processor agreements and oversight of sub-processors
We identify where you already meet the requirements, where the gaps are, and what to prioritise. Because GDPR is a regulation rather than a certifiable standard with a single issuing body, there is no single GDPR certificate. Organisations that want to certify an aligned privacy programme can use ISO 27701, a standalone privacy management system standard since its 2025 edition, or an approved GDPR certification scheme under Article 42. Many organisations pair GDPR work with ISO 27701.
Typical timeline
A GDPR readiness and gap assessment typically takes 8–12 weeks, depending on your size, the number of processing activities and how much documentation already exists. Closing the gaps that the assessment surfaces runs alongside or after it, on a timeline you control. As with every engagement, we start with a fixed-price scoping call and send a proposal within 24 hours.
Common questions
Is GDPR mandatory for companies outside the EU?
Often, yes. The GDPR applies extraterritorially: any organisation that offers goods or services to, or monitors the behaviour of, individuals in the EU must comply regardless of where it is based. The UK GDPR places equivalent obligations on processing relating to individuals in the UK — which is why so many SaaS and technology companies address both.
Is there an official GDPR certificate?
There is no single official “GDPR certificate” issued by one body — compliance is demonstrated through your records, policies and practices. One certifiable route is ISO/IEC 27701, a privacy management system standard (standalone since its 2025 edition) that maps closely to GDPR. GDPR also allows approved certification schemes under Article 42, such as Europrivacy, which the European Data Protection Board has approved as a European Data Protection Seal.
How is GDPR different from ISO 27701?
GDPR is a law that sets obligations; ISO 27701 is a certifiable management system standard. Implementing ISO 27701 gives you an audited framework that maps onto many GDPR requirements, which is why organisations often use it to demonstrate their privacy programme to customers and regulators.
What are the penalties for non-compliance?
The GDPR provides for administrative fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements. Beyond fines, non-compliance carries real commercial and reputational risk when buyers audit how you handle personal data.