GDPR Compliance

The General Data Protection Regulation (Regulation (EU) 2016/679) is the EU's data protection law, applicable since 25 May 2018. It governs how organizations process the personal data of individuals in the EU and requires appropriate security measures and proof those safeguards actually work, not merely documentation that they exist.

Appropriate measures scaled to the risk: the ongoing confidentiality, integrity, availability, and resilience of systems, the ability to restore availability after an incident, and a process for regularly testing the effectiveness of those measures.

Both controllers (who determine the purposes and means of processing) and processors (who process on a controller's behalf) are directly bound. The Regulation applies to any organization, wherever established, processing the personal data of individuals in the EU.

Yes. Regular testing of effectiveness is an explicit obligation, and controllers must be able to demonstrate compliance. The existence of a control is not accepted as proof that it works.

As of June 2026, the proposed amendments (19 November 2025) remain proposals, not law — adoption is expected in the second half of 2026, with application not before late 2027. They do not change the security-of-processing obligations, and the in-force 72-hour breach-notification rule continues to apply.

The 2026 amendments are still proposals, not law. As of June 2026, the Commission's proposed changes — part of the Digital Omnibus and a broader cybersecurity package, focused on incident notification routing, scope clarifications, and certification-based pathways — remain in the legislative process and have not been adopted. They do not alter the core Article 21 risk-management obligations or the Article 23 reporting triggers and deadlines that compliance rests on.

Documentation proves a control was put in place; it does not prove it still works once detection rules decay, permissions drift, or new attack techniques emerge. Validating controls against real adversary behavior turns prevention and detection outcomes into audit-ready evidence.

Inadequate security can draw fines up to €10 million or 2% of worldwide annual turnover, rising to €20 million or 4% where a basic processing principle is engaged — whichever is higher — plus possible processing bans, erasure orders, and compensation claims.

As of June 2026, the GDPR applies in its current form, and the Digital Omnibus proposals had not altered the security-of-processing obligations or the in-force 72-hour breach-notification rule. Specific provisions and any fine or turnover figures should be confirmed against the official EUR-Lex text before relying on them.

The Picus Platform continuously validates control effectiveness through adversary-emulated techniques in a production-safe manner. It helps controllers and processors meet GDPR requirements by verifying whether exposures are actually exploitable, testing whether monitoring tools detect malicious behaviors, prioritizing remediation based on validated exploitability rather than theoretical severity, and generating objective, MITRE ATT&CK-mapped evidence for supervisory authorities, audits, and post-incident reviews.