Home  /  GDPR
GDPR · EU data protection

Ready for EU customers, without the guesswork.

If you sell to people in the EU or track their behaviour online, GDPR can apply wherever you are based. We work out whether it applies to you, close the gaps and leave you with privacy practices you can show a customer.

Applies?We tell you straight
Privacy by designBuilt into how you work
AlignedWith the Australian Privacy Act
In short: GDPR can apply to Australian businesses that sell to or monitor people in the EU. Cyber Veda checks whether it applies to you, closes the gaps and aligns your privacy program with the Australian Privacy Act.

Why GDPR comes up

It usually arrives with a European deal: a customer sends a data processing agreement or a privacy questionnaire, and you need credible answers fast. Regulators can impose significant fines, but for most businesses the bigger risk is a lost deal.

Does GDPR apply to you?

GDPR follows the people, not where your company is registered. Article 3 sets out when it reaches a business outside the EU.

Does GDPR apply to you?A yes to any one of these usually brings you into scope
  1. Art. 3(1) Do you have an establishment in the EU? For example: An office, branch or staff there
  2. Art. 3(2)(a) Do you offer goods or services to people in the EU? For example: EU languages or currencies, EU delivery, marketing aimed at the EU
  3. Art. 3(2)(b) Do you monitor the behaviour of people in the EU? For example: Tracking, profiling or behavioural advertising

If yes, the seven principles apply (Art. 5)

  • Lawfulness, fairness and transparency
  • Purpose limitation
  • Data minimisation
  • Accuracy
  • Storage limitation
  • Integrity and confidentiality
  • Accountability

One privacy program, not three

GDPR, the Australian Privacy Act and ISO 27701 cover a lot of the same ground. We build your privacy practices once and map them to each, so you are ready for EU customers and local obligations at the same time, and can move to ISO 27701 certification if customers ask for it.

What's included

  • Applicability check: whether and where GDPR applies to your business
  • Data mapping and records of processing activities
  • Lawful basis, privacy notices and consent reviewed
  • Processes for data subject requests and breach notification
  • International transfer safeguards and supplier contracts reviewed
  • Data protection impact assessments where they are needed

When you'd use this

  • You are expanding into Europe or already have EU customers
  • An EU customer has sent you a data protection questionnaire or agreement
  • You want privacy practices that also hold up under Australian privacy law
FAQ

Common questions

Does GDPR apply to Australian businesses?

It can. GDPR applies to organisations outside the EU that offer goods or services to people in the EU, or monitor their behaviour, for example through online tracking. Having EU customers or EU website visitors does not automatically mean it applies, which is why we start with an applicability check.

Is there a GDPR certificate?

Not in the way there is for ISO 27001. GDPR is about being able to demonstrate compliance. If you want an independently certifiable privacy system, ISO 27701 is the closest fit, and it maps directly to GDPR requirements.

Do we need an EU representative?

Usually, if GDPR applies because you offer goods or services to, or monitor, people in the EU and you have no EU establishment. Article 27 requires you to appoint a representative in the EU, with limited exceptions for occasional, low-risk processing.

Do we need a Data Protection Officer?

Only in specific cases: if your core activities involve large-scale, regular and systematic monitoring of people, or large-scale processing of sensitive data, or you are a public authority. Many businesses appoint a privacy lead instead.

How quickly do we have to report a data breach?

Where a breach is likely to put people’s rights at risk, you must notify the relevant supervisory authority within 72 hours of becoming aware of it, and tell affected individuals without undue delay if the risk is high.

Can EU personal data be transferred to Australia?

Yes, with safeguards. Australia does not have an EU adequacy decision, so transfers usually rely on Standard Contractual Clauses plus a transfer risk assessment. EU customers will often ask to see these in your data processing agreement.

What are the penalties under GDPR?

The most serious breaches can attract fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher. In practice the bigger risk for most Australian businesses is losing an EU deal because they can’t answer the customer’s privacy questions.

How does GDPR compare with the Australian Privacy Act?

They overlap a lot, but GDPR is generally stricter on lawful basis, individual rights and transfers. Building to GDPR usually puts you in a strong position under the Privacy Act too, and we align the two so you run one privacy program.

Talk to someone who has taken companies like yours to audit.

Book a free 30-minute consultation. Tell us what is driving the need, and leave with a realistic timeline and the first three things to do.

Book a 30-min consultation Explore services