Who this is for
U.S. companies that have an establishment in the EU, or that offer goods and services to people in the EU or monitor their behavior, which is how the GDPR's territorial scope reaches organizations outside Europe. Companies with EU-based employees or contractors should check their position too. For aerospace suppliers, personal data often comes into scope through a European customer or partner relationship. UK operations carry the parallel UK GDPR.
What we deliver
Applicability & data mapping
Where the GDPR applies to you, and a record of processing activities (Article 30) covering HR, customer, partner, and program data, with systems and locations.
Lawful basis & notices
Lawful basis for each processing purpose, and privacy notices for employees, candidates, customers, and website visitors that match what actually happens.
DPIAs
Data protection impact assessments for high-risk processing such as monitoring, large-scale special-category data, or new technologies, including AI.
International transfers
Transfer mapping and mechanisms for EU personal data moving to the U.S.: adequacy under the EU-U.S. Data Privacy Framework where the recipient is certified, standard contractual clauses and transfer assessments where not.
Processors & vendors
Article 28 processor agreements, vendor due diligence, and sub-processor tracking, reusing your supplier register from supply chain risk work.
Rights & breach response
Data subject request handling and a breach process that meets the GDPR's 72-hour notification window alongside DFARS 7012's 72-hour report to DoD.
Breach reporting under the GDPR and DFARS 7012
| Question | GDPR | DFARS 252.204-7012 |
|---|---|---|
| What triggers it | Personal data breach | Cyber incident affecting covered defense information |
| Who you tell | Supervisory authority; affected people when risk is high | DoD via the DIBNet portal |
| How fast | Within 72 hours of becoming aware, where feasible | Within 72 hours of discovery |
| What you keep | Documentation of every breach, notified or not | Images of affected systems for at least 90 days |
The transfer question: keeping CUI in a U.S.-only environment like GCC High is right for DFARS. When that environment also holds personal data of people in the EU, the move there is an international transfer that needs a mechanism and documentation. We design both requirements together so neither program undermines the other.
How an engagement runs
- Map (2 to 4 weeks): applicability, record of processing, and transfer map.
- Remediate (4 to 8 weeks): lawful bases, notices, DPIAs, processor agreements, and transfer mechanisms.
- Integrate: a joint breach playbook with your DFARS incident process, and rights-request handling.
- Operate: annual ROPA refresh, new-processing reviews, and vendor tracking as part of Managed Compliance.
Questions contractors ask us
We're a U.S. company. Does the GDPR really apply?
It can apply through an EU establishment, such as a subsidiary or branch, or when you offer goods or services to people in the EU or monitor their behavior. Many U.S. defense suppliers find their exposure through EU employees, subsidiaries, or partner programs rather than consumer sales.
Do we need an EU representative or a DPO?
A non-EU organization that falls under the GDPR without an EU establishment generally needs an EU representative unless an exception applies. A Data Protection Officer is required in specific cases, such as large-scale monitoring or large-scale special-category processing. We assess both as part of applicability.
Can we rely on the EU-U.S. Data Privacy Framework?
Where the U.S. recipient is certified under the Framework, the European Commission's adequacy decision covers the transfer. Where it isn't, standard contractual clauses with a transfer assessment are the usual route. We map each flow and document the mechanism.
Do you provide legal advice?
No. We build the program, the records, and the processes; your privacy counsel confirms legal positions such as lawful basis choices and applicability, and the program documents their decisions.
Find out where the GDPR reaches your business.
Tell us where you have EU people, customers, or entities, and we'll scope the applicability analysis and data map. Or email rj@indirectit.com directly.