Articles tagged: GDPR
6 articles on GDPR from the Top Floor insights library.
2026-08-25
How Long Does GDPR Readiness Take? The Clocks That Actually Set the Date
GDPR has no certificate and no finish line, so the honest question is how long it takes to build a defined readiness file. No primary source publishes a project duration. What the Regulation does publish is a set of clocks, and those, plus the count of systems you hold, are what set the calendar.
2026-08-25
What Is a RoPA, and Does a Small Company Have to Keep One?
A record of processing activities is the Article 30 register a supervisory authority can demand on request. The under-250 derogation is narrower than most content implies: any one of three conditions removes it, and a small company that pays staff has already met one of them.
2026-08-25
What Is a Lawful Basis Under GDPR, and Why Can You Not Change It Later?
Every processing purpose needs one of the six Article 6 grounds before collection starts, and the EDPB's rule is that the choice cannot be swapped afterwards. Which basis fits which purpose, the three-step test behind legitimate interests, and the mistake of treating consent as the safe default.
2026-08-23
Does GDPR Apply to My US Company?
GDPR reaches a US company with no EU office at exactly two triggers, and there is no revenue floor or headcount threshold under either. The targeting test, the fact patterns that put you outside the Regulation, and what changes the day you decide you are inside it.
2026-08-23
How Long Do You Have to Respond to a DSAR? Every Deadline
One month under GDPR, 45 calendar days under CCPA and the state laws that copied it, 10 business days just to acknowledge in California, and 15 business days to stop selling. The clocks, the trigger events, and the intake failure that blows all of them at once.
2026-08-23
Do US Websites Need a Cookie Banner?
Mostly no, and the ones running EU-style opt-in banners are usually failing the obligation they actually have. What US state law requires instead, the two carve-outs that do demand consent, and when the ePrivacy rules reach you.