GDPR

The regulation is built on a small number of ideas that recur throughout it. Processing needs a lawful basis. It must be limited to a stated purpose and to the data that purpose actually requires. It must be transparent to the people whose data it is, who hold enforceable rights over it. And it must be secured, with the measures proportionate to the risk.

The distinction that matters most in a software purchase is between the controller, who decides why and how personal data is processed, and the processor, who processes it on the controller’s documented instructions. When a company buys a collaboration platform, the company is the controller for everything its people put into it and the vendor is the processor. That relationship must be written down in a contract meeting Article 28, and the vendor cannot take it on for the customer.

Because of this split, "GDPR compliant" is not a property a product can have on its own. A product can provide the controls and the paperwork compliance requires — a processing agreement, a subprocessor list, export and deletion, security measures — while the lawful basis, the retention decisions and the transparency to staff remain the customer’s.