{"id":35699,"date":"2025-11-25T12:51:33","date_gmt":"2025-11-25T12:51:33","guid":{"rendered":"https:\/\/grapenordic.com\/gdpr-compliance-in-the-eu\/"},"modified":"2025-12-02T11:14:43","modified_gmt":"2025-12-02T11:14:43","slug":"gdpr-compliance-in-the-eu","status":"publish","type":"post","link":"https:\/\/grapenordic.com\/en\/gdpr-compliance-in-the-eu\/","title":{"rendered":"GDPR compliance in the EU"},"content":{"rendered":"[vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” top_padding=”80px” top_padding_tablet=”20px” top_padding_phone=”0px” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/6″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][\/vc_column_inner][\/vc_row_inner][\/vc_column][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”2\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_column_text css=”” text_direction=”default”]\n

GDPR compliance<\/span> in the EU<\/h1>\n

At its core, GDPR compliance is about processing personal data legally, securely and documentably – and being able to demonstrate this to customers, employees and regulators. It’s not a folder in SharePoint, it’s a way of working: clear purposes, right legal bases, good information practices, appropriate security and ongoing documentation. <\/span> <\/span><\/p>\n

Who is covered and when?<\/h2>\n

The rules apply to organizations that process personal data of data subjects in the EU\/EEA, regardless of whether the company itself is located inside or outside the EU. This means that both Nordic companies and global players selling to EU citizens must be able to explain why they collect data, how they protect it and how long they store it. If you have cross-border processing, you can get a lead supervisory authority via the one-stop-shop mechanism, but national differences in language and practices still come into play. <\/span> <\/span><\/p>\n

What does “one-stop-shop” and a “lead” regulator mean?<\/h2>\n

If your processing of personal data is cross-border<\/span><\/b>you will generally have <\/span>one primary supervisory authority<\/span><\/b> (a <\/span>lead supervisory authority<\/span><\/i>LSA), which coordinates the case across the EU. This makes the dialog simpler because LSA is your main contact in cases of <\/span>the treatment in question<\/span><\/b>. <\/span>gdpr-info.eu<\/span><\/a> <\/span><\/p>\n

When do you have an LSA?<\/span><\/b><\/h3>\n

When you are either (a) established in multiple member states and process data across them or (b) a single establishment processes data that <\/span>significantly affect<\/span><\/b> data subjects in multiple countries. This is the GDPR’s definition of “cross-border processing”. <\/span>edpb.europa.eu<\/span><\/a> <\/span><\/p>\n

How do you determine which authority is the lead?<\/span><\/b><\/h3>\n

LSA is the supervision where you have your <\/span>“main establishment” for the specific treatment<\/span><\/b>-typically the place where the <\/span>most important decisions about purpose and means<\/span><\/b> are made and where they can be <\/span>implemented<\/span><\/b>. This can vary per treatment (e.g. marketing may have one LSA, HR another), depending on where decisions are actually made and implemented. <\/span>edpb.europa.eu+1<\/span><\/a> <\/span><\/p>\n

What doesn’t one-stop-shop change? <\/strong><\/h3>\n