Executive Summary: What is it?
GDPR is a comprehensive legal framework for data protection and privacy in the European Union and the European Economic Area. It mandates how personal data must be processed and gives individuals significant rights over their data.
CFO / Business Impact: What does it cost/risk?
- Sovereignty Compliance: Essential for European operations. Non-compliance can lead to fines of up to EUR 20 million or, for an undertaking, 4% of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(5)).
- Consumer Trust: Self-hosting keeps personal data under your own control, which makes the controller's duties easier to show; it does not meet them by itself.
Technical Reality: How does it work?
- Data Portability: Where processing rests on consent or a contract and is automated, individuals can receive the personal data they provided in a structured, commonly used and machine-readable format and pass it to another controller (Article 20(1)). The EU Data Act (Regulation 2023/2854) is a separate law: its by-design access duty covers connected products and related services placed on the market after 12 September 2026 (Article 50).
- Right to be Forgotten: The controller must erase a person's data without undue delay where a ground in Article 17(1) applies and no exception in Article 17(3) does. The duty binds the controller, not the software maker; a controller therefore needs software that can erase one person's data across all storage layers.
What the Label Means in a Solution Profile
- Self-Hosted line: "GDPR Ready" means the free self-hosted build lets you find, export and erase one person's data, sends no personal data to its maker or third parties by default, and has the basic security controls (encryption, role-based access, audit logs and data export). The legal duties stay with you as the controller.
- Managed service line: "GDPR (Audited)" means a GDPR certification under a scheme listed in the European Data Protection Board's register. "GDPR (Self-Assessed)" means the provider's own formal document: a GDPR entry in its trust center, a published data processing agreement, or adherence to an approved code of conduct. ISO 27001, ISO 27701, SOC 2 and EU hosting do not count. No certification reduces the controller's responsibility.