GDPR: what it requires and how to comply
GDPR has been in force for years, but proving compliance year after year is still hard work: records of processing, data subject rights, impact assessments and breach notification within 72 hours. Atalaya GRC centralises your data protection documentation and tracks deadlines so nothing slips by.
No commitment. We’ll walk you through the platform with a real case.
- Reference
- Reg. (EU) 2016/679
- Applies from
- 25 May 2018
- Who
- Any company processing personal data
- If you don’t comply
- Up to €20M or 4% of turnover
What is GDPR?
The General Data Protection Regulation (EU 2016/679), or GDPR, governs how organisations handle personal data. It also rests on one key principle: accountability (complying isn’t enough, you must be able to prove it). In Spain it’s complemented by the LOPDGDD.
Who does GDPR apply to?
GDPR applies to any organisation processing the personal data of EU residents, whatever its size or sector. It also reaches companies outside the EU that offer goods or services to people in the Union or monitor their behaviour. For a point-by-point review, also see our 2026 compliance checklist.
What does GDPR require?
Above all, these are the obligations you have to cover:
Records of processing (RoPA)
Records of processing activities and a legal basis for each processing operation before it starts.
Data subject rights
Access, rectification, erasure, objection, portability and restriction, handled on time, generally within one month.
Breach notification
Notification to the authority (AEPD) within a maximum of 72 hours, and also informing those affected when the risk is high.
What happens if you don’t comply?
GDPR fines reach up to €20 million or 4% of total worldwide annual turnover, whichever is higher. And a growing risk: when a cybersecurity breach involves personal data, it can open two parallel proceedings —GDPR before the AEPD and, where applicable, NIS2—.
GDPR impact assessments and DPO
In addition, GDPR requires data protection impact assessments (DPIA) for high-risk processing, and the appointment of a Data Protection Officer (DPO) where applicable given your activity or the volume and type of data.
Atalaya GRC
How Atalaya GRC helps
Atalaya GRC also puts your data protection under control:
- Centralised documentation: RoPA, DPIA and clauses with an audit trail, ready to prove compliance whenever you are asked.
- Breach management: the 72-hour clock stays under control while the AEPD notification is prepared in line with the GDPR.
- One control, several regulations: GDPR’s security measures are also reused with ISO 27001, NIS2 and ENS.
- Accountability: the evidence you need, so you can demonstrate compliance to the authority.
Want to see it with your own processing activities?
Request a demoFAQ
Frequently asked questions
How long do I have to report a breach?
You have a maximum of 72 hours from becoming aware of it to notify the AEPD, unless the breach is unlikely to result in a risk to people.
What penalties does GDPR carry?
Up to €20 million or 4% of total worldwide annual turnover, whichever is higher.
Do I need a DPO?
It depends on your activity and the volume and type of data. However, many organisations need one or outsource it.
Can a breach be sanctioned under both GDPR and NIS2?
Yes: when the incident affects personal data and network security, parallel proceedings can be opened.
Atalaya GRC
How Atalaya GRC helps with the GDPR
Operational privacy in one place: Records of Processing Activities (ROPA), data protection impact assessments (DPIA), data subject rights management (DSAR), evidence and an audit log.
