Confirm GDPR applies and what it asks
Who it covers, what it asks for in plain words, and the dates that matter. The regulator has the final say; we read it with you.
Privacy · EU / national DPAs
EU General Data Protection Regulation
Applies when you offer goods or services to people in the EU or monitor their behaviour. Lawful basis, rights handling and 72-hour breach notice.
Rather skip the call? Get a fixed-fee GDPR quote in writing.
One control set, every frameworkLed by Sam Khan, CISA and CRISCPublic pricing
Who it applies to
The businesses that carry GDPR, and the pages written for them.
Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.
Which packages prepare you for it
Cyber and Data Protection Assessment
Any business of 10 to 500 people that has never had a real assessment, or has not had one in a year
There is no GDPR package of its own yet. The Cyber and Data Protection Assessment covers the controls most of it shares with other frameworks, and the GDPR-specific requirements are scoped with you in a 30-minute call.
What it asks for
In plain English, what GDPR expects you to have in place.
- A data mapWhat personal data you collect, why, where it goes and how long you keep it.
- A lawful basis and a noticeA reason for each use and a privacy notice that says so in plain language.
- Rights handlingA process to answer access, correction, deletion and opt-out requests within the required time.
- Security appropriate to the riskTechnical and organizational measures that match the sensitivity of the data.
- Processor and vendor termsContracts that bind the companies processing data on your behalf.
- Breach notificationA tested process to assess a breach and notify the authority and the people affected on the clock the law sets.
A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.
Where it starts
Your one-stop shop for GDPR
GDPR applies to a US company that offers goods or services to people in the EU or monitors their behavior. It wants a data map, a lawful basis for each use, a notice that says so, a way to answer rights requests, processor contracts and a breach process on a 72-hour clock.
We draw the map, write the notice and the contracts, and build the breach process on the security controls you already run.
Trace the data: tick what is true
Tick what applies and we show which GDPR duties start for you.
The steps
Six steps from "does GDPR apply to us?" to evidence you can show
The whole GDPR journey, short version. We handle every step with you.
Scope it
Which systems, data, people and vendors are in. A clear boundary is a smaller job and a cleaner answer.
With AccuSights: we scope it with you from the intake form and put it in writing.
Run the gap assessment
What you have versus what the rule expects: tooling, configurations, policies and the records that prove each one.
With AccuSights: your engineer tells you how far each control needs to go.
Fix and document
Most gaps are in the policies and workflows nobody wrote down, not the firewall.
With AccuSights: remediation is in-house or with your IT provider, verified in your real environment.
Stay continuously compliant
Controls drift between reviews. Someone has to notice.
- Data map currentPassing
- Processor contracts signedPassing
- Rights requests answered on timePassing
- Breach plan rehearsedPassing
With AccuSights: our endpoint agent and monitoring catch the drift and flag it to your engineer.
Report, renew, reuse
The evidence that proves it, filed where the next inspector, auditor or customer can find it, and mapped to the next framework you need.
With AccuSights: evidence keeps collecting itself, so next year is a renewal and not a rerun.
Why AccuSights
Why small teams pick AccuSights for GDPR
Most compliance platforms assume you have a security team. We built this for the companies that do not.
Priced for a startup, not a Series D
One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.
The endpoint agent is built in
Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.
A human who has done this before
A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.
Written once, read everywhere
One control set is mapped to every framework you carry, so evidence is produced once and reused.
What it costs
What GDPR costs, in plain numbers
Here is what is published, with who published it and when.
$0There is no GDPR certification to buy for a small company; the cost is the data map, the documents and the controls.Source: EU GDPR, Regulation (EU) 2016/679
A fixed feeReadiness and the fixes, in writing within 24 hours of the intake form.Source: AccuSights pricing page (2026)
From $25 a user a monthProtect: AI-powered monitoring of your computers and email day and night, with AccuSights engineers who call you. 10 users minimum.Source: AccuSights pricing page (2026)
Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.
Self-serve compliance software
- You get a portal and drive it yourself.
- Expert help is often a separate purchase or a partner referral.
- Device checks usually need an MDM you set up first.
- Pricing comes after a sales call.
AccuSights
- A named engineer runs it with you.
- Guidance and remediation are included, not referred out.
- The endpoint agent ships with the platform.
- A fixed fee, in writing, within 24 hours of the intake form.
Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing
Read more
More on GDPR, in plain words.
Questions
GDPR questions we get every week
How fast must a GDPR breach be reported?
To the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put people at risk (Article 33). When the risk to people is high, tell them too without undue delay (Article 34). Record every breach, reported or not.Source: GDPR text, EUR-Lex
Do we need an EU representative?
Usually, if GDPR applies to you through offering goods or services or monitoring and you have no EU establishment. Article 27 requires a written designation of a representative in the EU, with an exception for occasional processing that is unlikely to create risk and does not involve special categories on a large scale.Source: GDPR text, EUR-Lex
How can we move EU personal data to the US?
Two common routes: certify under the EU-US Data Privacy Framework, covered by the European Commission adequacy decision of July 2023, or sign the Commission's standard contractual clauses with a transfer assessment. Check that your cloud and software vendors use one of them too.Source: Data Privacy Framework program
Is GDPR compliance the same as SOC 2 or ISO 27001?
No, but they overlap on security. GDPR adds privacy duties those standards do not cover in full: lawful basis, notices, rights requests, retention and transfers. Article 32 security can be evidenced with the same controls as SOC 2 or ISO 27001, which is how we keep the work to one set.Source: GDPR text, EUR-Lex
Do you act as our DPO or EU representative?
No. We are not a law firm and do not act as a data protection officer or EU representative. We map your data, build the security and evidence side of GDPR, and work alongside your counsel and representative, who keep the legal judgments.
Do you certify GDPR compliance?
No. We do not certify, and the regulator, examiner or independent auditor for GDPR has the final say. We interpret the requirements for your business, scope what applies, close the gaps and keep the evidence current, so you go into any audit, assessment or examination with the evidence already in hand.
Where do we start with GDPR?
With the 3-minute Cyber Hygiene Test if you want a number today, or with the 30-minute call if you want a written scope and a fixed fee. Either way the first deliverable is a gap list ranked by what would fail and what would hurt.
We also need other frameworks. Do we do GDPR separately?
No. We build one control set and map it to every framework you carry, so evidence is produced once and reused. Adding a framework later is a mapping exercise, not a second program.
Also in Privacy: State Privacy · every framework by industry
Next step
Thirty minutes, an engineer, a written scope for GDPR.
Book the demo and see how one control set carries GDPR and everything else you owe. Or leave your details and an engineer replies within one business day.