Compliance Colleague · Standards · EU & UK

GDPR (EU and UK): cited answers and gap reviews

An AI compliance assistant for DPOs, privacy counsel and product teams · updated 2026-10-03

The General Data Protection Regulation governs personal data in the EU, and the UK GDPR in the UK. Compliance Colleague answers with the article cited, reviews privacy notices, DPAs and DPIAs, and checks data flows against the regulation, including UK changes from the Data (Use and Access) Act 2025.

Try it on your own GDPR work: one document review or two questions, free for 30 days, no card required. Start free →

What it covers

Lawful bases, data subject rights and transparency
Controller and processor duties, DPAs and records of processing
DPIAs, breach notification and security of processing
International transfers
UK GDPR as amended by the Data (Use and Access) Act 2025

Questions you can ask

“When do we need a DPIA under Article 35?”
“Can we rely on legitimate interests for product analytics?”
“What must a processor agreement contain under Article 28?”

Every answer cites the GDPR requirement, article or control it rests on, so you can check it in seconds.

What you can upload for review

Your privacy notice checked against Articles 13 and 14
A data processing agreement checked against Article 28
A personal-data flow diagram checked for transfers and missing safeguards

Files: PDF, Word, Excel or CSV, Visio (.vsdx), draw.io, or an image such as a screenshot. Choose a full review, a prioritized fix list (each gap with its fix and the evidence an assessor will expect) or a short summary, and download the result as Word or PDF.

Crosswalk GDPR to other standards

With GDPR in your plan you can compare it against any standard in the library and see where they align and exactly where they don’t. Common pairings:

Example answers

How long do we have to answer a GDPR subject access request, and can we extend it?

What it’s built from

Compliance Colleague carries the official text and checks its answers against it: Regulation (EU) 2016/679 (General Data Protection Regulation) (Publications Office of the European Union (EUR-Lex)).

Re-checked every month for new versions, deadlines and penalty changes. Full list on the sources page.

More EU & UK standards

EU AI Act · NIS2 · DORA · EU Cyber Resilience Act · CSRD

Compliance Colleague covers 30+ security, privacy and AI governance standards. It reviews policies, spreadsheets and diagrams and answers questions with the clause cited; your judgment and sign-off stay with you. Try it free, no card required →

Research aid, not legal or audit advice, and not an audit opinion or certification. Verify findings against the official text before relying on them.