GDPR's reach is what makes it a global standard rather than a purely European one. It applies to any organisation processing the personal data of individuals in the EEA, regardless of where the organisation is based — the so-called extraterritorial scope. A US company with EU customers, a Brazilian processor handling EU data on behalf of a controller, and an Asian service with EU users all fall under GDPR. For any organisation touching the European market, GDPR is the baseline privacy obligation.
The regulation rests on a set of processing principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Controllers — the organisations that decide why and how data is processed — must be able to demonstrate compliance with these principles, which in practice means documented records, DPIAs for high-risk processing, appropriate technical and organisational measures, and a lawful basis for every processing activity.
Individuals receive a broad set of enforceable rights: to be informed, to access, to rectify, to erase, to restrict, to port, and to object. Exercising these rights is the subject-to-access request process every controller must operate. The integrity and confidentiality principle, together with the broader security obligation, is where cybersecurity and GDPR most clearly meet: an organisation must implement appropriate technical and organisational measures to protect personal data, and a failure to do so is both a security incident and a regulatory breach.
Breach notification is one of GDPR's most operationally significant requirements. A personal data breach likely to result in a risk to individuals must be notified to the supervisory authority within 72 hours of the controller becoming aware of it, and high-risk breaches must also be communicated to the affected individuals without undue delay. Meeting the 72-hour window requires preparation: an incident response plan that identifies personal-data involvement, a ready process for assessment and notification, and the forensic and legal capability to make a defensible notification decision under time pressure.
Passeca supports GDPR compliance across its security-relevant obligations: security measures appropriate to the risk, personal-data breach detection and the 72-hour notification process, DPIAs for high-risk processing, and the technical controls — encryption, access management, logging, and monitoring — that the regulation and the supervisory authorities expect. This work is often combined with ISO 27001 and NIS2 programmes, which share a substantial control overlap with GDPR's security requirements.