GDPR compliance requirements apply to any organization that processes personal data of EU or UK residents, regardless of where that organization is headquartered. For IT teams, that means specific technical controls, encryption, access management, breach response, and audit documentation, are not optional; they are legally mandated under penalty of fines up to €20 million or 4% of global annual revenue, whichever is higher.
This guide covers what those requirements actually look like at the device and infrastructure layer, how to operationalize them systematically, and where compliance automation fits into a sustainable GDPR program.
The GDPR is built on seven data protection principles defined in Article 5. Every technical decision you make about data handling should trace back to at least one of these.
1. Lawfulness, fairness, and transparency: Personal data must be collected on a valid legal basis (consent, contract, legitimate interest, legal obligation, vital interests, or public task) and subjects must be informed how their data is used.
2. Purpose limitation: Data collected for one purpose cannot be repurposed for an unrelated one. Your database schema and app permissions matter here.
3. Data minimization: Collect only what is necessary. If your app requests access to a contact list when it only needs an email address, that is a violation waiting to happen.
4. Accuracy: You must keep personal data accurate and up to date, with processes in place to correct or delete inaccurate records.
5. Storage limitation: Data should not be retained longer than necessary. Retention schedules, automated deletion, and archival policies are operational requirements.
6. Integrity and confidentiality: This is Article 5(1)(f), and it maps directly to your security controls, encryption, access controls, and incident response.
7. Accountability: You must be able to demonstrate compliance. Documentation, audit trails, and evidence collection are not optional extras.
The accountability principle is where most organizations stumble. Regulators do not assume good intent, they expect evidence.
Article 32 requires organizations to implement "appropriate technical and organisational measures" to ensure a level of security appropriate to the risk. The regulation names specific measures:
For IT teams managing device fleets, this maps directly to:
The phrase "appropriate to the risk" gives organizations some latitude, but regulators evaluate appropriateness against the sensitivity of the data involved. Healthcare or financial data demands stricter controls than a marketing email list.
Article 25 requires that privacy be built into systems from the start, not retrofitted after deployment. In practice, this means:
For device management, Article 25 is one of the strongest arguments for enforcing baseline configurations at enrollment rather than relying on end users to configure their own devices correctly. A managed device that ships with encryption enabled, screen lock enforced, and unapproved app installation blocked is implementing data protection by design. An unmanaged BYOD device is not.
If your organization has not yet formalized how you handle personal data on employee-owned hardware, the BYOD device management considerations around GDPR are worth examining carefully before your next audit.
GDPR grants individuals eight rights over their personal data. For each one, your organization needs a documented process to respond within the required timeframe (generally 30 days, extendable to 90 days for complex requests).
1. Right of access (Article 15): Subjects can request a copy of all personal data you hold on them. You need data mapping to know where that data lives.
2. Right to rectification (Article 16): Subjects can request correction of inaccurate data. You need a process to update records across all systems.
3. Right to erasure (Article 17): Also called the "right to be forgotten." Subjects can request deletion of their data under specific conditions.
4. Right to restriction of processing (Article 18): Subjects can ask you to pause processing while a dispute is resolved.
5. Right to data portability (Article 20): Subjects can request their data in a structured, machine-readable format.
6. Right to object (Article 21): Subjects can object to processing based on legitimate interests or direct marketing.
7. Rights related to automated decision-making (Article 22): Subjects have the right not to be subject to solely automated decisions that significantly affect them.
8. Right to withdraw consent: Where consent is the legal basis, it must be as easy to withdraw as it was to give.
The erasure right has a direct device management implication. If an employee leaves or a device is lost, remote wipe is not just a security measure, it is a GDPR compliance mechanism. You need documented proof that the wipe occurred, which means your MDM needs to log the action with a timestamp.
Organizations with 250 or more employees (and smaller organizations that process sensitive data or do so regularly) must maintain a Record of Processing Activities under Article 30. IT typically owns or contributes to a significant portion of this document.
A ROPA entry for each processing activity must include:
From an IT perspective, this means you need visibility into every system that touches personal data: CRM, HRIS, support ticketing, cloud storage, endpoints. Hardware inventory management is a prerequisite for accurate ROPA documentation, you cannot document what you cannot see.
Article 35 requires a Data Protection Impact Assessment before any processing that is "likely to result in a high risk" to individuals. Mandatory scenarios include:
A DPIA is not a one-time exercise. If you deploy a new HR analytics tool, a monitoring solution for remote workers, or expand your data processing to new geographies, you need to assess whether a DPIA is required before go-live.
The output of a DPIA is a documented risk assessment with mitigations. If residual risk remains high, Article 36 requires prior consultation with your supervisory authority before processing begins.
A Data Protection Officer (DPO) is mandatory under Article 37 for:
Even if a DPO is not legally required, many organizations appoint one voluntarily because GDPR audits and breach notifications are complex to manage without dedicated expertise. The DPO must have access to senior management and must not receive instructions on how to perform their tasks, they report directly to the highest management level.
Article 33 requires notification to your supervisory authority within 72 hours of becoming aware of a personal data breach, where that breach is likely to result in a risk to individuals' rights and freedoms. Where the risk is high, Article 34 also requires notification to the affected individuals without undue delay.
The 72-hour clock starts when you have enough information to confirm a breach has occurred. This means your incident response process needs to:
1. Define what constitutes a personal data breach (unauthorized access, accidental disclosure, data loss on a device)
2. Establish an escalation path from the person who discovers the incident to whoever is responsible for supervisory authority notification
3. Document each stage of the response with timestamps
4. Maintain a breach register, even for incidents that do not cross the notification threshold
A lost laptop without full-disk encryption is a notifiable breach. A lost laptop with verified FileVault encryption and a confirmed remote wipe may not be, depending on what other data it contained. This is one reason encryption enforcement and remote wipe documentation are directly tied to your GDPR obligations, not just general security hygiene.
If you share personal data with a third party that processes it on your behalf (a cloud provider, a payroll vendor, a support tool), GDPR requires a Data Processing Agreement (DPA) under Article 28. That agreement must specify:
Processors also bear direct legal obligations under GDPR, including the requirement to maintain their own security measures and notify the controller without undue delay upon becoming aware of a breach.
For IT teams, this means your vendor onboarding process must include a DPA review step. It also means you need a list of sub-processors for each vendor. SaaS sprawl makes this difficult without a structured SaaS management process.
Transferring personal data outside the EEA requires one of several legal mechanisms:
For US-based companies with EU operations, confirm that your DPAs with US vendors include the current SCCs and that your transfer impact assessments are documented.
Use this as a working reference, not a complete legal framework. Consult legal counsel for jurisdiction-specific requirements.
Data Inventory and Mapping
Technical Controls
Organizational Measures
Legal Basis and Rights
Third Parties and Transfers
Ongoing Compliance
GDPR compliance at the endpoint layer is where many organizations have the most documentation gaps. Policies exist on paper, but enforcement is inconsistent, and when an auditor asks for evidence that FileVault was enabled on every Mac during the audit period, manual screenshots do not hold up.
Iru Endpoint enforces device-level controls that map directly to Article 32 and Article 25 requirements:
Iru Compliance handles the documentation and evidence side:
For understanding what is IT compliance more broadly and how device management fits into a compliance program, Iru's approach keeps enforcement and evidence in the same platform so neither operates as a black box to the other.
GDPR is not a project with a completion date. It is a continuous program that requires ongoing enforcement, evidence collection, and adaptation as your data processing activities change.
The organizations that fare best in regulatory investigations and audits are the ones that can produce documentation quickly and demonstrate that controls were consistently enforced, not just that policies were written. That distinction matters when a supervisory authority is deciding whether to issue a formal enforcement action or accept a remediation plan.
Start with the controls that carry the highest enforcement risk and are most technically addressable: full-disk encryption, access management, breach response procedures, and your ROPA. Then build toward continuous monitoring so that compliance is not a quarterly scramble but a verifiable, ongoing state.
GDPR compliance gets more defensible when enforcement and evidence live in the same place. Iru offers device management and compliance as separate products or as one, whichever matches where you are today. Book a demo.