GDPR compliance for business

Quick logic of the packages

Package 1 — GDPR Start

Price: from 900 EUR | Term: 7–10 working days

For whom: small business, websites, landing pages, simple e-commerce projects, MVP, services without complex processing of personal data and without a significant volume of users from the EU.

Package 2 — GDPR Business

Price: from 2,500 EUR | Term: 15–20 working days

For whom: SaaS, e-commerce, marketplaces, IT companies, agencies, companies with clients or users from the EU that need not just a set of documents, but an understandable compliance structure.

Package 3 — GDPR Pro / Investor Ready

Price: from 5,000 EUR | Term: 25–35 working days

For whom: companies with active sales in the EU, FinTech, HealthTech, EdTech, AI/ML, HR-tech, marketplaces, services with a large volume of user data or preparation for due diligence.

Comparison of GDPR Packages

When GDPR may apply even if you are not in the EU

GDPR may apply to a business outside the EU if it offers goods or services to people in the EU or monitors their behavior. What matters is not only the country of company registration but the actual operational model with the European audience.

• You offer goods or services in the EU: for example, SaaS, a mobile application, e-commerce, a subscription, or an online service.
• You track user behavior: through analytics, profiling, cookies, advertising identifiers, SDKs, or other tracking tools.

Quick self-assessment

• Do you have clients or users from the EU?
• Does the website or application have prices in euros, delivery to the EU, or localization in the languages of EU countries?
• Do you use cookies, SDKs, analytics, advertising, or profiling?

If the answer is “yes” to at least one question, this is a reason to conduct an assessment of GDPR applicability. One indicator does not always mean automatic application of the Regulation, but ignoring it is already risky.

What most often stops deals and GDPR checks

In practice, problems arise not because of the absence of a single document, but because of a gap between policies, contracts, and the actual business processes.

• No data map: it is unclear what data is collected, why, where it is stored, and to whom it is transferred.
• Undefined roles: the company does not understand when it is a controller, processor, or joint controller.
• Absence of DPA or other contractual terms: with cloud services, CRM, analytics, support, payment providers, and other contractors.
• Unregulated data transfers: personal data is transferred outside the EU/EEA without a proper mechanism or risk assessment.
• No DSAR process: the team does not know how to respond to requests regarding access, deletion, portability, or objection to data processing.
• No incident scenario: there is no clear course of action in the event of a leak or data security breach.

Roles: controller, processor, and joint controller

A correctly defined role is the basis for contracts, policies, responsibility, and the architecture of GDPR documents.

Controller: determines why and how personal data is processed.

Processor: processes data on behalf of the controller and according to its instructions.

Joint controllers: two or more parties jointly determine the purposes and key means of data processing.

Example for SaaS

• If a client uploads the contacts of their users into your service, the client is often the controller, and the SaaS company is the processor.
• If you collect user data for your own marketing, analytics, or sales, you usually act as a controller.

Practical framework for GDPR preparation: 10 directions

1. Data mapping. We determine what data is processed, where it comes from, where it is stored, and to whom it is transferred.
2. RoPA. If necessary, we prepare or update the register of processing operations: purposes, data categories, retention periods, recipients, transfers, and security measures.
3. Lawful basis. We define the legal basis for each key process: contract, legal obligation, legitimate interest, consent, etc.
4. Transparency. We prepare a Privacy Notice, Cookie Notice, and other documents explaining to the user exactly how data processing works.
5. Cookie and tracking management. We check the banner, consent logic, and the use of analytical or advertising tools.
6. Vendors and contracts. We prepare DPAs, vendor clauses, and other contractual mechanisms for working with contractors and processors.
7. Data subject rights. We build a DSAR process and response templates to typical user requests.
8. Security and incidents. We form basic rules for access, incident response, and internal escalation logic.
9. DPIA. We assess whether a specific process requires a Data Protection Impact Assessment due to a high risk to the rights and freedoms of users.
10. Data transfers. We analyze transfers outside the EU/EEA and determine the appropriate mechanism: adequacy decision, SCC, DPF, or other safeguards depending on the situation.

Data transfers: SCC, DPF, and TIA

If personal data is transferred outside the EU/EEA, it is necessary to assess the data route, the recipient, and the legal transfer mechanism.

• Adequacy decision: for individual countries or mechanisms recognized by the European Commission as providing an adequate level of protection.
• EU–US Data Privacy Framework: can apply to American companies participating in the Framework.
• Standard Contractual Clauses: are used when there is no corresponding adequacy mechanism for the transfer.
• Transfer Impact Assessment: helps to assess the risks of a specific transfer and the need for additional protection measures.

Documents without a real process do not solve the problem. If data is actually transferred via CRM, cloud, analytics, or support services, this must be reflected in the data map, contracts, and internal procedures.

Fines and commercial risks

For certain GDPR violations, administrative fines of up to 20 million euros or 4% of total worldwide annual turnover of the preceding financial year can be applied — whichever is higher.

For business, the practical risk often arises earlier: a check from a client, bank, PSP, investor, or a large counterparty can delay the deal, increase the volume of legal requests, or change the terms of cooperation.

How Prikhodko & Partners helps

We analyze actual processes of working with personal data and prepare documents and procedures that can be used in work with clients, contractors, and during audits.

• Audit and data map: sources, systems, vendors, transfers, and key risks.
• Roles and contracts: controller / processor, DPA, and terms for contractors and sub-processors.
• Policies and internal processes: Privacy Notice, Cookie Notice, retention, DSAR, and incident response.
• Complex cases: SCC / DPF, international transfers, and DPIA — if necessary.

GDPR is like a seat belt: it seems unnecessary exactly until the first sudden braking. It is better to have your own, rather than one imposed by the client’s lawyer right when the deal is “almost signed”.