Want to get ready for
GDPR?
GDPR is not a framework you can select in Strac Comply yet. Here is what it asks for. And here is the part of the work you can run today, through SOC 2 and ISO 27001.
14-day free trial. No credit card.
Read our GDPR guideWhat is GDPR?
GDPR (EU 2016/679)
General Data Protection Regulation
EU data protection
GDPR is the EU's data protection law, in force since May 2018. It applies to any company, anywhere, that handles personal data of people in the EU.
It asks for a lawful basis for processing, data minimization and strong security. It also asks for breach notice within 72 hours, data subject rights and a record of your processing activities. Fines reach €20 million or 4% of global annual turnover, whichever is higher.
Where Strac Comply helps with GDPR today
You can't protect personal data you can't account for.
Article 30 asks for a record of your processing. Article 28 asks for a contract with every processor. Article 32 asks for appropriate security.
Strac Comply already helps with all 3 through SOC 2 and ISO 27001. We have also mapped 73 GDPR controls to the regulation's articles. You can't select them in the product yet.
What you can do today
These run in Strac Comply now, through the frameworks we support. GDPR itself is on our roadmap.
Draft your Records of Processing Activities (RoPA) with AI, then review and approve it. Today it counts as SOC 2 Privacy and ISO 27001 A.5.34 evidence
Track the data processing agreement for every vendor in your vendor register, next to its risk score
Run daily tests on encryption, MFA and access across AWS, Google Workspace, Okta and more. That is the kind of security Article 32 asks for
Log security incidents with the date you found them and the steps you took. You'll have the facts when a 72-hour clock starts
Keep a record of every data subject request, and track security training for your whole team
Where the work overlaps
GDPR requirements, and the evidence Strac Comply can already keep for them.
- Art. 5(2)
Accountability
Policy library with approvals and review dates
- Art. 15 to 22
Data subject rights
Data subject request records (SOC 2 Privacy)
- Art. 28
Processors
Vendor register with agreement status per vendor
- Art. 30
Records of processing
AI-drafted RoPA (SOC 2 Privacy, ISO 27001 A.5.34)
- Art. 32
Security of processing
Daily encryption, MFA and access tests
- Art. 33
Breach notification
Security incident log with dates
Frequently asked questions
Can I run GDPR in Strac Comply today?
Not as its own framework yet. GDPR is on our roadmap.
Today you can run SOC 2, including its Privacy criteria, or ISO 27001. Both produce much of the evidence GDPR work needs: a RoPA, processor agreements, security tests and an incident log.
Strac Comply won't show a GDPR readiness score until GDPR ships.
Does SOC 2 or ISO 27001 make us GDPR compliant?
No. They overlap with Article 32 and parts of Articles 28 and 30.
GDPR also asks for a lawful basis, privacy notices and data subject rights. It also asks for safeguards for data you send outside the EU.
Think of SOC 2 or ISO 27001 as the security half of the work.
Do we need a Data Protection Officer (DPO)?
Only if Article 37 requires one. You need one if you are a public authority. You also need one if your core work involves large-scale monitoring of people or large-scale processing of special-category data.
Many SaaS companies don't need one.
Frameworks you can run in Strac Comply today
Start with what your buyers ask for.
Most teams start with SOC 2 or ISO 27001. Run either in Strac Comply today, and the security work carries over.
14-day free trial. No credit card. Plans from $4,995 per year. See pricing · Browse integrations