You’ve seen the headline buzz around GDPR. Maybe you’ve received a text from an unknown advertiser, got a random email from a business you never contacted, or noticed ads on sites and social media that feel like they “know too much” about you. Maybe you switched health insurance and wondered what happened to your old records. Or you’re simply curious about what big digital players (like Google or Facebook) do with all that data.
This guide will help you understand General Data Protection Regulation (GDPR), eIDAS Regulation (eIDAS), and the practical side of information security in a simple way.
We’ll walk through what they mean for individuals, managers in various roles (IT, HR, legal), and organisations. No heavy legalese. Rather, take clear steps you can act on today. And yes, there are ways your organisation (with expert help from us at ComsignTrust) can turn this into business value and stronger trust with customers.
1. What is GDPR?
The GDPR is a European Union regulation that came into force on 25 May 2018. It aims to give people control over their personal data, ensuring businesses and organisations handle it responsibly.
Why it matters
Until now, many companies have treated collected data as their own asset. Under GDPR, it belongs only to the individual (the “data subject”), and they have defined rights over it.
What falls under “personal data”?
Anything that allows you to be identified, directly or indirectly – such as names, identity numbers, addresses, IP addresses, bank info, health data, behavioural profiles.
Key rights of individuals
Consent
A business must clearly explain why it needs your data and get your explicit agreement. You can withdraw that consent at any time.
Right of access
You have the right to see the data a business holds about you and receive a copy in a usable format.
Right to correction
If the data about you is wrong, you can ask for it to be fixed.
Right to erasure (“right to be forgotten”)
Under certain conditions, you can ask a business to delete your data.
Data portability
You can ask for your data in a format that you can pass to another provider.
Does GDPR apply to US companies?
Yes – sometimes.
If you:
- Offer goods or services to individuals in the EU, or
- Monitor the behaviour of individuals in the EU (e.g., tracking, profiling). Then, you may fall under GDPR obligations.
2. What is eIDAS, and why does it matter
The eIDAS Regulation is the EU’s framework for electronic identification and trust services, such as electronic signatures, electronic seals, time-stamps, and website authentication.
- It ensures an electronic signature has the same legal weight as a handwritten one (in member states).
- It supports cross-border digital identity (so an ID issued in one EU country may be recognised elsewhere).
- It works hand-in-glove with GDPR: if your business uses electronic signatures or identity verification, you must still comply with personal data protections.
Why it’s relevant for you: if your organisation uses digital identity, signatures, or trust services, this is the framework that may apply (especially in/with EU clients or partners).
3. Information Security: the practical baseline
GDPR and eIDAS aren’t just legal checklists – they demand good information-security practices. For example, GDPR Article 32 says you must implement “appropriate technical and organisational measures” (encryption, anonymisation, access controls) to protect personal data.
Frameworks that help
- NIST Cybersecurity Framework (widely used in the U.S.) – provides core functions: Identify, Protect, Detect, Respond, Recover.
- ISO/IEC 27001 – internationally recognised standard for information security management.
Here’s a simple mapping table:
| GDPR requirement | Typical action |
| Data minimisation & lawful basis | Only collect what you need, document why |
| Encryption & access control | Encrypt stored data; restrict access by role |
| Passwordless authentication (FIDO2) | FIDO2 authentication offers a strong, phishing-resistant method that aligns with GDPR’s requirement to protect personal data from unauthorised access. |
| Incident response | Have a plan: detect breach, notify authorities/subjects |
| Vendor/sub-processor management | Ensure third parties comply, update contracts |
4. Role-Based Action Sheets
For the CISO / IT Manager
- Inventory all systems processing personal data.
- Define access privileges (who can see what).
- Enable encryption (at rest and in transit).
- Check vendor APIs, cloud configurations, and sub-processors.
For the Privacy Officer / Legal Team
- Audit data flows: where and why you collect data.
- Update privacy notices and obtain clear consent.
- Run DPIAs (Data Protection Impact Assessments) for high-risk processing.
- Review contracts and cross-border data transfers (SCCs, adequacy decisions).
For the HR / Admin Manager
- Employee data should be subject to the same rules: only collect essential info, store securely, and restrict access.
- Update onboarding/off-boarding processes so data deletion is baked in.
For the Small Business Owner
- Step 1: Map what personal data you collect (customers, employees).
- Step 2: Write a simple privacy notice, and get clear customer consent.
- Step 3: Set a data-retention schedule: decide when to delete or archive old records.
Free resource: Download our “GDPR + eIDAS Quick Start Checklist” (see bottom of this article).
5. Two Realistic Example Scenarios
Scenario 1: U.S. SaaS company selling to EU customers
- Day 1: Run a signup-form audit. What personal fields do you collect? Are they necessary?
- Day 2: Add a lawful basis column to each field (consent, contract, legitimate interest). Remove optional fields you don’t need.
- Day 3: Update your privacy notice + cookie banner. Include “You can withdraw consent any time.”
- Week 2: Conduct a DPIA on your analytics engine (profiling behaviour). Is it “high risk” under GDPR? If yes, apply mitigation (pseudonymise data, allow opt-out).
- Week 3: Review all vendor contracts. If you transfer data from or to the EU, ensure Standard Contractual Clauses (SCCs) or other lawful mechanisms.
Scenario 2: Health-insurance plan migration
An organisation switched health plans and wants to know: “What happens to the old medical records?”
Under GDPR (and equivalent privacy laws), you must ask: Do you still need the data? If not → schedule for secure deletion. Ensure the incoming plan obtains a proper consent or basis for processing. Maintain a deletion log.
6. How to implement Privacy-by-Design & Secure Lifecycle
Think of your product or service from idea to deletion:
- Idea phase → ask “What data will we collect? Why?”
- Design phase → embed minimal data collection, pseudonymisation, default privacy settings.
- Build phase → allocate roles, define access, encrypt data, log actions.
- Test phase → run vulnerability tests, check vendor interfaces, simulate deletion workflows.
- Operate phase → monitor access, respond to data-subject requests (access, correction, deletion).
- End-of-life phase → securely archive or delete data, remove backups.
This lifecycle approach aligns with both GDPR’s requirement for security and eIDAS’s trust-services model (if you use electronic signatures or identity verification).
7. Common Compliance Traps & How to Avoid Them
- Assuming U.S. firms are exempt: If you engage EU individuals, you’re in scope.
- Weak consent language: “By continuing, you accept our policy” is not enough – must be clear, unbundled, and specific.
- Weak authentication methods: Relying on passwords alone exposes organisations to most data protection breaches. Stronger options like FIDO2 eliminate password theft and significantly lower GDPR security risks.
- Cloud misconfigurations: Data on cloud storage with overly broad access is a common breach vector.
- Vendor/sub-processor risk: You remain responsible for your vendors, ensure their compliance, and audit rights.
- Cross-border transfers: After Schrems II, relying on Privacy Shield isn’t enough; you need SCCs or equivalent safeguards.
8. How Comsign-Trust Helps
You don’t need to wait for a data breach or compliance fine. Take control of your organisation’s privacy and security today.
- Ensure every document, signature, and invoice meets GDPR and eIDAS standards with Comsign’s trusted digital signature and security solutions. We also support FIDO2 authentication within our CCMS, giving organisations a passwordless, phishing-resistant login method that directly strengthens GDPR security controls and reduces the risk of data protection breaches.
- Contact us now to schedule a free consultation and discover how to safeguard your data, strengthen trust, and streamline your digital operations.
“Already collecting EU data? Download our free ‘GDPR + eIDAS Implementation Checklist’ or schedule a remediation call with our experts.”
9. Checklist & Downloadable Resource
Ready to act? Use our free downloadable resource:
“GDPR + eIDAS Implementation Checklist & Role Worksheets”
Includes:
- 10-point checklist for small business owners
- Role worksheets for IT, Legal/Privacy, HR
- Sample consent language
- Data-flow map template & deletion schedule
Download now → GDPR + eIDAS Implementation Checklist & Role Worksheets.pdf
Conclusion & Next Steps
Data-protection and secure digital identity no longer live in the “nice to have” zone – they’re essential trust elements for your customers, partners and regulators. Start with one clear action this week: map what personal data you collect and why. Then move on to tightening “who can access it” and “how long you keep it”.
If you’d like help getting started, we at Comsign-Trust are here. Protect your business and stay GDPR-compliant with Comsign’s digital signature and security solutions.
📩 Contact us now to get started. Download the checklist, book your free audit, and let’s make compliance a business enabler, not a burden.
FAQs
Does GDPR apply to my US-based business with no EU customers?
Possibly not – but if you process EU-citizens’ data (e.g., remote employees, EU marketing list) you could be in scope.
What is an “eIDAS qualified signature”?
It’s a type of electronic signature under eIDAS that has the highest legal assurance level (the equivalent of a handwritten signature under EU law). Using it may help meet signature and identity-verification obligations.
How long does it take to align with ISO 27001 or NIST CSF?
It depends on your size and maturity. A focused gap analysis might take 4-6 weeks; full certification could take 6–12 months.
