Included in every plan
Start package, size S
€199 net per month
The GDPR is included as baseline protection in every Complass plan, from Start.
Framework · GDPR – General Data Protection Regulation
GDPR: Prove it instead of searching folders
You must process personal data lawfully and be able to prove it at any time. Complass guides you from clarifying roles to evidence for the supervisory authority.
This framework is also available on its own with a fixed scope: also as an individual package
What is GDPR?
The GDPR is Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data. It has applied directly in all Member States since 25 May 2018 and requires, among other things, a legal basis for every processing activity, transparent information, fulfilment of data subject rights, appropriate security and the notification of data breaches.
Content as of:
Does it apply to me?
The GDPR applies to every company that processes personal data, regardless of size and sector: data of employees, applicants, customers, contact persons and website visitors. It covers processing in the context of an establishment in the EU and offers to persons in the EU from outside.
Many obligations also apply to processors, i.e. service providers who process data on behalf of others. Whether a data protection officer must be designated depends on the activity and on national law.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Legal basis
- Art. 2 DSGVOArticle 2 GDPR Material scope1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. 2. This Regulation does not apply to the processing of personal data: - (a) in the course of an activity which falls outside the scope of Union law; - (b) by the Member …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗Material scope
- Art. 3 DSGVOArticle 3 GDPR Territorial scope1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗Territorial scope
- Art. 4 DSGVOArticle 4 GDPR DefinitionsFor the purposes of this Regulation: - (1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗Definitions
- Art. 24 DSGVOArticle 24 GDPR Responsibility of the controller1. Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗Responsibility of the controller
- Art. 37 DSGVOArticle 37 GDPR Designation of the data protection officer1. The controller and the processor shall designate a data protection officer in any case where: - (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; - (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗Designation of the data protection officer
Key dates
-
Regulation applies in all Member States
Art. 99(2)Article 99 GDPR Entry into force and application1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. 2. It shall apply from 25 May 2018.Open original (EUR-Lex – consolidated version incl. corrigenda) ↗
-
One month
Response to data subject requests, extendable by two months given the complexity and number of requests
Art. 12 DSGVOArticle 12 GDPR Transparent information, communication and modalities for the exercise of the rights of the data subject1. The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗
-
72 hours
Notification of a data breach to the supervisory authority, without undue delay and where feasible within 72 hours of becoming aware
Art. 33 DSGVOArticle 33 GDPR Notification of a personal data breach to the supervisory authority1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗
How Complass helps
- 9phases
- 31guided steps
- 14document templates
- 64requirements in the catalogue
Guided in nine phases
Roles and data protection organisation, record, legal bases, data subject rights, processing on behalf and third countries, TOMs and deletion concept, impact assessment, data breaches, and operation and evidence.
Obligations catalogue by article
Every obligation from Art. 5 to Art. 49 with applicability, status and evidence, plus a catalogue of measures under Art. 32, linkable with ISO 27001 and NIS2.
Templates with completion guidance
Including record of processing activities, legal-basis matrix, privacy notices, data subject request process, DPA checklist, transfer assessment, TOMs, deletion concept, DPIA and data breach register.
Linked to the ISMS
You use assets, risks, suppliers and document control jointly for data protection and information security.
For day-to-day operations: you keep records, processors, TOMs, impact assessments and data subject requests as a register with deadlines and exports in the privacy operations module. More about privacy operations
The phases in the module
- Project start, roles and data protection organisation
- Inventory and record of processing activities
- Principles, legal bases and consent
- Transparency and data subject rights
- Processing on behalf, joint controllership and third-country transfers
- Technical and organisational measures, privacy by design and deletion concept
- Data protection impact assessment
- Detect, notify and document data breaches
- Operation, monitoring and evidence towards the supervisory authority
Catalogue: Obligations under the GDPR
GDPR in Complass
The GDPR is included as baseline protection in every Complass plan. A larger plan adds further modules.
Recommended
Business
€590 net per month
More impact with Asset management and zones, Supplier Management and Business continuity management (BCM), room for 10 users and 2 frameworks.
With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 6 November 2026. All packages and modules in the price overview
You can also meet the obligations without Complass. Complass supports implementation and evidence and does not replace legal advice. Legal information
Frequently asked questions
Does Complass replace a data protection officer?
No. Complass structures implementation and evidence; advice and monitoring remain the task of the data protection officer where one is designated. The content does not replace legal advice.
Does Complass notify data breaches to the supervisory authority?
No. Complass helps with assessment, content and documentation of the notification; you submit the notification via your supervisory authority’s reporting channel.
Does the module also apply outside Germany?
Yes. The content follows the Regulation, which applies in all Member States. German specifics from the BDSG are marked as national notes; you check national rules of other Member States yourself.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.