The world's most far-reaching data protection law. GDPR governs how you collect, process, and transfer the personal data of EU residents — and it applies wherever your company is based if you serve EU customers.
The General Data Protection Regulation is binding EU law, not a certification. It sets out principles for lawful processing, strengthens individual rights, and imposes obligations such as records of processing, data protection impact assessments, breach notification, and — in many cases — a Data Protection Officer.
Its reach is extraterritorial: any organisation offering goods or services to people in the EU must comply, regardless of where it operates. Penalties run to €20 million or 4% of global annual turnover, whichever is higher.
Compliance is an ongoing programme rather than a one-time event. ISO 27701 provides a certifiable privacy management system that maps directly onto GDPR obligations.
Applies regardless of where your company is registered.
Organisations whose model depends on collecting or processing personal data.
Both sides of a data relationship carry distinct GDPR obligations.
Delivered through our specialist network. We map your data flows, build the required documentation and processes, and — where you want certifiable proof — implement ISO 27701 on top, giving you an auditable privacy management system rather than a binder of policies.
We define the boundary of your programme — systems, locations, and teams in scope — and agree the timeline and responsibilities up front, so there are no surprises later.
A structured assessment of your current posture against every requirement, producing a prioritised remediation plan with realistic effort estimates.
We write the policies, procedures, and controls, and work alongside your engineering team on a weekly cadence to implement them — not a stack of templates left for you to figure out.
The management system runs and generates evidence. We drive the internal audit and management review so the programme is demonstrably working before any external scrutiny.
We prepare the evidence package and sit alongside you through assessment, answering the assessor's questions directly rather than leaving you to defend the work alone.
If you serve customers in both the UK and the EU, you deal with two closely related data protection regimes. Understanding where they match and where they differ saves time and avoids duplicated work.
EU GDPR applies to organisations that offer goods or services to people in the EU or monitor their behaviour, wherever the organisation is based. UK GDPR, together with the Data Protection Act 2018, is the UK's version of the same law, retained in UK law after Brexit and supervised by the ICO. The core principles, lawful bases, individual rights, breach notification and impact assessments are largely the same.
Where they differ is mostly in the details: separate regulators and enforcement, their own rules and safeguards for international transfers, and a UK framework that continues to evolve, for example through the Data (Use and Access) Act 2025. If you serve people in both jurisdictions, you generally need to satisfy both.
Companies outside the UK and EU. If your business is based elsewhere, for example in the GCC or the US, but you serve UK or EU residents, you may also need a UK representative and an EU representative. Whether this applies depends on your circumstances and is a point to confirm with your legal counsel.
Proving it. There is no single official GDPR certificate. ISO 27701 gives you a certifiable privacy management system that maps onto GDPR obligations. See our ISO 27701 page, and our ISO 27001 page for the security side.
Remote-first delivery. ISONEX works remotely with clients across the GCC, UK, EU and US. We map your data flows and build the required documentation and processes; for legal advice we work alongside your counsel. This page is general information, not legal advice. Book a free advisory session.
Yes, if you offer goods or services to people in the EU or monitor their behaviour. The regulation is deliberately extraterritorial, which is why GCC and other non-EU companies routinely need a GDPR programme.
There's no single official GDPR certificate, but ISO 27701 gives you a certifiable privacy information management system that demonstrates systematic compliance — which is the closest auditable proof available and what we typically recommend.
Yes. ISONEX is a remote-first consultancy and we deliver privacy and compliance programmes for clients in the UK, the EU, the US and the GCC. Everything is done online, scheduled around your working hours.
They share the same core principles, rights and obligations. UK GDPR and the Data Protection Act 2018 form the UK regime under the ICO, while EU GDPR is enforced by EU supervisory authorities. Differences lie mainly in regulators, international transfer rules and ongoing UK reforms.
If you offer goods or services to people in both the UK and the EU, or monitor their behaviour, generally yes. A single well-built privacy programme can cover both, with a few jurisdiction-specific items. Confirm your exact position with legal counsel.
Organisations based outside the UK or EU that are subject to the regulation may need to appoint a representative in each. Whether it applies to you depends on your circumstances, so check with your legal counsel.
It does not replace GDPR compliance, but it gives you a structured security framework that supports the security requirements of GDPR. ISO 27701 extends it to privacy. See our ISO 27001 page for how they fit together.
Book a free advisory session and we'll map your fastest credible route to compliance.
Book a free advisory session