Since its 2018 implementation, the European Union General Data Protection Regulation (GDPR) has been a foundational data protection law that changed how organizations collect, process, and manage sensitive data. The GDPR is one of the earliest regulations that establishes jurisdiction based on the data subject’s citizenship and residence rather than on the organization’s location. Additionally, it also established fines that organizations need to pay if they are found to violate the requirements.
By understanding how to comply with GDPR requirements, organizations can extend their global business reach while improving data security and privacy.
What Is GDPR?
The General Data Protection Regulation (GDPR) is a comprehensive data privacy law enacted by the European Union that governs how organizations collect, process, store, and protect the personal data of EU residents. The GDPR applies to any organization that processes the personal data of any EU residents, including citizens from non-European Union countries.
Adopted in April 2016 and enforced starting May 25, 2018, GDPR replaced the EU’s 1995 Data Protection Directive and set a new global benchmark for data privacy regulation. It’s widely considered one of the strictest privacy laws in the world.
If found to violate the GDPR, organizations face fines up to €20 million or 4% of a company’s global annual revenue, whichever is higher.
Who does GDPR apply to?
The GDPR applies to any company that:
- Offers goods or services to individuals in the EU.
- Monitors the behavior of individuals located in the EU, including through website cookies or analytics.
- Processes personal data on behalf of another organization that falls under GDPR.
The GDPR broadly defines four categories of data:
- Personal data: Information relating to an identified or identifiable natural person, like name, birth date, email address, IP address, cookie IDs. bank account information, credit card numbers, and social identity information.
- Special category data: Heightened protection for more sensitive data types, like race, ethnicity, political opinion, religion, trade union membership, genetic data, biometric data, health data, and sexual orientation.
- Criminal offense data: Criminal conviction and offenses data requires specific legal authority to process.
- Pseudonymized data: Processed data no longer attributable to a specific person without additional information.
Does GDPR Apply to U.S. Companies?
Although the GDPR is a law enacted in the European Union, any companies in the US that collect information from European residents must comply with the requirements. The regulation focuses on the data subject location, meaning that US companies must ensure that their data collection practices meet EU standards.
What are the 7 Principles of the GDPR?
The GDPR establishes seven general principles related to collecting, processing, sharing, and handling covered data.
1. Lawfulness, fairness, and transparency
Organizations must have a legitimate reason for processing personal data and must clearly tell users how they will use the data. Transparency requires providing concise, easy-to-understand privacy notices. Processing should never be deceptive or unfairly detrimental to the individual.
2. Purpose Limitation
Organizations must collect data for specific, explicit, and legitimate purposes. After collecting the data, they cannot repurpose the information for a completely unrelated activity without gaining additional consent.
3. Data Minimization
Organizations should only collect the data that is strictly necessary for the intended purpose.
4. Accuracy
Organizations must maintain accurate and up-to-date data. They should take reasonable steps to erase or update inaccurate information as quickly as possible, especially if a data subject requests a change.
5. Storage Limitation
When organizations keep personal data in a form that permits identification, they should store for no longer than they need it. Once the data no longer serves its original purpose, they must securely delete or anonymize it.
6. Integrity and Confidentiality
Organizations must process data in a secure way. They should implement the technical and organizational measures necessary to protect it from unauthorized or unlawful processing, accidental loss, destruction, or damage.
7. Accountability
Organizations must be able to demonstrate compliance to regulators. The process requires documentation, training, and regular audits.
What are the requirements for GDPR compliance?
While the guiding principles define the GDPR’s approach, several articles speak to data security and privacy concerns.
Article 25: Privacy by Design and Default
Article 25 states:
Data controllers must implement appropriate organizational and technical controls to ensure that personal data processing is limited appropriately and that personal data remains private unless the individual provides consent.
Organizations must build data protection into products and services from the earliest design stages and ensure the strictest privacy settings apply automatically by default.
Article 28: Processor (Vendor) Obligations
Article 28 states:
Data controllers must ensure that processors provide a contractual guarantee to implement appropriate technical and organizational measures that protect data subject rights.
Organizations must have a signed Data Processing Agreement (DPA) in place with any third-party vendor that processes data on their behalf, ensuring the vendor upholds equivalent security standards.
Article 32: Security of Processing
Article 32 states:
Data controllers and processors shall implement the appropriate technical and organizational measures to ensure that their security controls appropriately mitigate risk.
Organizations must implement appropriate technical and organizational measures to protect personal data at a level appropriate to the risk. Some techniques for protecting data include:
- Encryption
- Pseudonymization
- Regular security testing
Article 33: Breach Notification to Supervisory Authorities
Article 33 states:
Controllers must notify the supervisory authority within 72 hours of becoming aware of a data breach related to personal data.
Organizations must notify the relevant supervisory authority within 72 hours after discovering a data breach. If they fail to notify a supervisory authority within that time, then they need to give a reason for the delay.
Article 34: Breach Notification
Article 34 states:
Controllers must communicate a personal data breach to the data subject without undue delay.
Organizations must provide notification about the breach to all people whose data may be impacted. The notification must be sent as quickly as possible, describing the data breach in clear and plain language.
Article 35: Data Protection Impact Assessment
Article 35 states:
Before engaging in high risk processing activities, controllers must assess the potential impact to personal data protection.
Organizations must conduct a Data Protection Impact Assessment (DPIA) for high-risk processing activities to formally evaluate potential risks and document how those risks will be mitigated.
Best Practice for GDPR Compliance Monitoring
GDPR compliance requires ongoing monitoring to ensure that controls remain effective over time. By collecting, correlating, and analyzing logs, organizations can implement high-fidelity alerts and track controls, making them audit ready faster.
Centralize Log Ingestion
To verify GDPR compliance, organizations need documentation. By aggregating data from all systems that touch personal data into a single monitoring view, organizations have real-time visibility into control effectiveness. Suggested activities include:
- Identifying every application, database, and cloud service that stores or processes personal data.
- Routing logs from all of these sources into one centralized platform.
- Prioritizing high-risk systems for ingestion first, like customer databases, CRMs, or marketing tools.
- Auditing regularly for shadow IT or unmonitored data stores.
Capture Detailed User and System Activity
Being able to answer who accessed personal data, what they did with it, and when is the foundation of GDPR accountability. Suggested activities include:
- Logging user identity, timestamp, source location, and action taken for every data interaction.
- Recording changes to access permissions, configurations, and data fields.
- Capturing both successful and failed access attempts.
- Assigning a unique event ID to each log entry for traceability.
Enforce Role-Based Access to Monitoring Data
Since logs contain personal data, organizations must protect them, too. Restricting who can view or manage them limits compliance risk. Suggested activities include:
- Applying least-privilege principles to log and monitoring system access.
- Limiting log management functions to designated compliance or security roles.
- Reviewing access permissions to logging tools on a recurring basis.
- Documenting approval processes for any expanded access.
Normalize and Standardize Collected Data
Raw, inconsistent logs are unusable in a compliance review, so standardizing formats is what makes monitoring data actually searchable and reportable. Suggested activities include:
- Parsing logs into consistent, defined fields.
- Standardizing naming conventions across systems and teams.
- Enriching logs with contextual metadata, like department, data category, purpose of processing.
- Establishing a consistent schema before scaling to new data sources.
Monitor for Anomalies and Correlate Events
By correlating events across the environment, organizations can surface active issues that can impact protected data that can help meet the breach notification requirements. Suggested activities include:
- Establishing baselines for normal access patterns to personal data.
- Setting alerts for unusual volume, timing, or scope of data access.
- Correlating related events across systems to detect broader patterns.
- Flagging access by service accounts or automated processes that falls outside expected behavior.
Automate Breach Detection and Alerting
The 72-hour breach notification clock starts the moment an organization becomes aware of an incident, so manual review is too slow to reliably meet that deadline. Suggested activities include:
- Configuring automated alerts for indicators of unauthorized access or exfiltration.
- Building a defined escalation path from alert to compliance or legal review.
- Logging the exact time an alert was generated and reviewed, to support the 72-hour timeline.
- Testing alerting workflows periodically through tabletop exercises.
Build Ongoing Compliance Dashboards and Reporting
Waiting until an audit or DPIA is due to assemble evidence creates unnecessary risk, so continuous reporting keeps compliance status visible at all times. Suggested activities include:
- Creating dashboards that track compliance-relevant metrics in real time.
- Scheduling recurring reports for data protection officers or compliance leads.
- Flagging gaps or overdue reviews automatically rather than manually.
- Retaining historical reports to show compliance posture over time.
Graylog: Enabling Continuous GDPR Compliance Monitoring
Graylog enables organizations to centralize, analyze, and act on security data at scale by providing the detection, investigation, and reporting capabilities that GDPR compliance requires. With centralized log management, real-time alerting, AI-assisted investigations, and purpose-built compliance dashboards, Graylog helps security and compliance teams demonstrate control effectiveness throughout the audit period and respond to incidents faster when they occur.
To learn more about how Graylog supports GDPR compliance and improves your overall security posture, contact us today for a demo.
