General Data Protection Regulation
The European Union's data protection regulation, which reaches organisations outside the EU whenever they process the personal data of people inside it.
NUEXUS delivers readiness, gap assessment, implementation support and evidence preparation. NUEXUS is not an accredited certification body and not an auditor, and cannot certify you, issue an attestation, or sign off on a result.
How it is organised
Lawful basis first
Every processing purpose needs a lawful basis chosen before processing starts, and consent is only one of them and often the weakest. Programmes that default to consent for everything create rights obligations they then cannot service.
Rights are operational, not legal, work
Access, rectification, erasure, portability and objection all have deadlines. Meeting them is an engineering and process problem, and it is where an otherwise well-documented programme usually breaks.
Accountability runs through everything
You must be able to demonstrate compliance. Records of processing, assessments for higher-risk processing, and documented decisions are the difference between a defensible position and an assertion.
What an assessor will ask to see
- Records of processing activities
- Lawful basis documented per purpose, with consent records where consent is used
- Data protection impact assessments for higher-risk processing
- Processor agreements with your suppliers
- Breach register and evidence that notification timelines can be met
Where it usually goes wrong
- Consent used as a catch-all basis, creating withdrawal obligations that cannot be honoured
- No data map, so erasure requests cannot be completed with confidence
- Processor agreements missing for tools adopted by individual teams
- Breach detection too slow to make the notification window realistic