Question 1

When does GDPR apply to me?

Accepted Answer

GDPR (and the parallel UK GDPR) applies whenever you process personal data of individuals located in the EU/EEA or UK, regardless of where your company is based. There is no minimum-volume threshold — one EU subject is enough to attach the regulation.

Question 2

What is a Data Subject Access Request (DSAR) and how fast must I respond?

Accepted Answer

A DSAR is a formal request from an individual asking what personal data you hold about them, why, and demanding correction or deletion. Under GDPR you have 30 days (extendable to 90 in complex cases). Under CCPA you have 45 days (extendable to 90). Failure to respond exposes you to administrative fines and private right of action.

Question 3

Do I need a DPIA?

Accepted Answer

A Data Protection Impact Assessment (DPIA) is required under GDPR Article 35 for processing likely to result in a high risk to individuals — including large-scale processing of sensitive categories (health, biometric, criminal records), systematic monitoring, or automated decisions with legal effect. Many US state laws (Colorado, Virginia, Connecticut) mirror these triggers.

Question 4

What sensitive categories trigger heightened obligations?

Accepted Answer

Under GDPR Article 9 and CCPA-CPRA: health and medical data, biometric data, racial or ethnic origin, religious beliefs, sexual orientation, government IDs (SSN, driver's license, passport), precise geolocation, and data of children under 13 (COPPA also applies in the US).

Does your business need a privacy scan?

Does your business collect, store, or process personal data (names, emails, IPs, identifiers, location, behaviour, etc.) of customers, employees, or website visitors?