What GDPR is and why buyers ask for it
The General Data Protection Regulation (GDPR) is the European Union’s data protection law, in force since 2018, governing how organisations collect, use and protect the personal data of individuals in the EU. The UK GDPR places equivalent obligations on data relating to individuals in the UK. Crucially, both apply extraterritorially: a business based anywhere in the world must comply if it offers goods or services to, or monitors the behaviour of, people in the EU or UK.
For B2B vendors, GDPR has become a standard part of due diligence. Enterprise buyers include data protection clauses in their contracts and ask suppliers to evidence how they meet their obligations as a controller or processor. An honest, documented GDPR position removes a recurring blocker in procurement. GDPR readiness is part of the broader Cyber Security and privacy work ABS supports.
What a GDPR assessment covers
GDPR compliance is not a single certificate — it is an ongoing programme. An ABS readiness and gap assessment reviews your processing against the regulation’s core requirements, typically including:
- Lawful basis for each processing activity, and how consent is captured where relied upon
- Data subject rights — access, rectification, erasure, portability and objection
- Records of processing and data mapping (Article 30)
- Data protection by design and by default, and Data Protection Impact Assessments for higher-risk processing
- Breach detection and notification within the required 72-hour window
- International transfers and the safeguards used for them
- Processor agreements and oversight of sub-processors
We identify where you already meet the requirements, where the gaps are, and what to prioritise. Because GDPR is regulatory rather than a certifiable standard with a single issuing body, the recognised way to certify an aligned privacy programme is ISO 27701 — many organisations pair the two.
Typical timeline
A GDPR readiness and gap assessment typically takes 8–12 weeks, depending on your size, the number of processing activities and how much documentation already exists. Closing the gaps that the assessment surfaces runs alongside or after it, on a timeline you control. As with every engagement, we start with a fixed-price scoping call and send a proposal within 24 hours.
Common questions
Is GDPR mandatory for companies outside the EU?
Often, yes. The GDPR applies extraterritorially: any organisation that offers goods or services to, or monitors the behaviour of, individuals in the EU must comply regardless of where it is based. The UK GDPR places equivalent obligations on processing relating to individuals in the UK — which is why so many SaaS and technology companies address both.
Is there an official GDPR certificate?
There is no single official “GDPR certificate” issued by one body — compliance is demonstrated through your records, policies and practices. The recognised, certifiable route to evidence a privacy management system aligned with GDPR is ISO 27701, which extends ISO 27001 to privacy.
How is GDPR different from ISO 27701?
GDPR is a law that sets obligations; ISO 27701 is a certifiable management system standard. Implementing ISO 27701 gives you an audited framework that maps onto many GDPR requirements, which is why organisations often use it to demonstrate their privacy programme to customers and regulators.
What are the penalties for non-compliance?
The GDPR provides for administrative fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements. Beyond fines, non-compliance carries real commercial and reputational risk when buyers audit how you handle personal data.
