GDPR compliance
Prove how you handle EU personal data
Records of processing, lawful bases, subject rights, and transfers, documented and current.
What GDPR is
The General Data Protection Regulation governs personal data of people in the EU and EEA, regardless of where your company is. It applies if you offer goods or services to them or monitor their behavior.
It requires a lawful basis for processing, records of processing activities, a way to honour data subject rights, controls on international transfers, and breach notification within 72 hours.
Who needs GDPR
You offer goods or services to people in the EU or EEA, or you monitor their behavior, regardless of where your company is established.
How TrustLynce helps with GDPR
Records of processing
Maintain the Article 30 record: what you process, why, on what basis, and for how long.
Subject rights
Track access, deletion, and portability requests against their deadlines.
Transfer mechanisms
Record the safeguards relied on for data leaving the EEA.
Processor management
Track sub-processors and their agreements.
GDPR questions
Yes, if you serve EU individuals or monitor their behavior.
Possibly, if you have no establishment in the EU.
Only in defined circumstances, not for every organization.
No. SOC 2 is security, GDPR is privacy and individual rights.
72 hours to notify the supervisory authority.
Other frameworks
Evidence collected for one framework carries into the next.
SOC 2
The one your buyers ask for
ISO 27001
Recognised worldwide
HIPAA
Protect health information
PCI DSS
Take card payments safely
ISO 42001
Govern how you use AI
NIST CSF
A common security language
CMMC
Work with the DoD
Custom
Your own control set
ISO 27701
Privacy extension to ISO 27001
DORA
EU financial operational resilience
NIS 2
EU critical infrastructure cybersecurity
CCPA / CPRA
California comprehensive privacy
FERPA
Student education privacy standard
FDA 21 CFR Part 11
FDA electronic records & signatures
HDS Certification
French health data hosting certification
SOX ITGC
IT controls for public companies
HITRUST CSF
Assurance healthcare buyers ask for
FedRAMP
Sell cloud services to US agencies
NIST SP 800-53
The federal security control catalog
NIST SP 800-171
Protect CUI on federal contracts
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.