- Home
- Suite features
- GDPR cockpit
GDPR compliance for companies outside the EU, mapped article by article
Regingada’s GDPR compliance software is the GDPR module of the Regingada Compliance Suite, called the GDPR twin. For companies outside the EU it asks five scoping questions, one of them a self-declared Article 27 question, classifies each processing activity you enter and lists the duties they point to, Article 5 to 49. It structures a first pass; it writes no contracts and decides nothing.
- GDPR · Art. 5–49
- Art. 27 flag
- Art. 28 · Art. 30 · Chapter V
- Transfer impact assessment · not modelled
- Contract text · not drafted
What should GDPR compliance software do for a company outside the EU?
GDPR compliance software for a company outside the EU should show which duties your processing points to and why, with the article attached, so that counsel can check the reasoning rather than rebuild it. It must also raise two of its own: the representative under Article 27 and transfers out of the EU under Chapter V (Articles 44 to 49).
The question rarely arrives as one: a customer’s data processing agreement, a procurement form asking for your records, a prospect asking whether your sub-processors sit under the Data Privacy Framework. As a GDPR compliance tool for US companies, the twin gives you one inventory and one obligations list to answer them from.
Five questions, one inventory, one obligations list
Open /suite/#gdpr. Sections have no addresses of their own; use the sidebar headed ‘GDPR · L4’.
- Confirm the legal notice. On a first visit, ‘Legal Notice & Disclaimer (Step 1: Orientation)’ waits for ‘Accept & Continue’.
- Pick the GDPR card. ‘Open GDPR twin →’ on the welcome screen starts the quick check.
- Answer five questions. Personal data; special categories (Art. 9); automated decisions under Art. 22 GDPR; establishment outside the EU with processing of people in the Union (Art. 27); consent (Art. 6(1)(a), Art. 7). ‘Unsure’ on Art. 9, Art. 22 or consent counts as yes; on Art. 27 only ‘Yes’ sets the duty. Closing without saving returns you to Home.
- Build the Processing Inventory. Per activity: name, purpose, one of seven roles (including ‘EU Representative (Art. 27)’), one of nine sectors, any of eleven feature chips. ‘+ Add Processing’ saves it with a tier chip.
- Work the obligations. Click ‘Obligations’: per card the article, effort, phase, tasks and ‘Show legal basis’. The DPIA, transfer, DPO, employment-data and V66 items show a notice until something triggers them.
Answers, inventory entries and ticked tasks stay in this browser’s local storage; there are no user accounts. Details: Trust Center.
Which GDPR duties does the twin map, and on which legal basis?
Twenty-one obligation cards, nineteen under the GDPR and two under Germany’s Federal Data Protection Act (BDSG), with 82 tasks. Fixed rules over your answers and chips select which appear, not a language model: a GDPR compliance checklist that names the article behind every card.
Records and the processor agreement
‘DPIA Records’ drafts the GDPR records of processing that Article 30 describes: fields labelled Art. 30(1)(a)–(g), a status, a JSON export. Its (a) field takes the activity’s name; add the controller’s, your EU representative’s and your DPO’s contact details yourself. ‘DPIA AVV’ is the Article 28 DPA checklist: eight Art. 28(3) clauses, four practice clauses and four modules of the standard contractual clauses (SCCs), each set by you to Compliant, Partial or Missing.
Both open only with the DPIA Cockpit (data protection impact assessment, Art. 35): when Art. 9 or Art. 22 GDPR is flagged, or the inventory’s top tier is ‘Elevated · DPIA required’ or ‘Extended · DPO required’. A third-country or legal-secrecy chip outranks both tiers.
International transfers: SCC, DPF, BCR
With the third-country chip set, four cards cover GDPR international transfers: adequacy (Art. 45), the EU-US Data Privacy Framework (DPF) included; SCCs (Art. 46(2)(c), Implementing Decision (EU) 2021/914) with the transfer impact assessment their Clause 14 requires after Schrems II (C-311/18); binding corporate rules (Art. 47); Art. 49 derogations.
The Article 27 flag
A quick-check question, an inventory role and a card whose four tasks include the Art. 27(2) exemption assessment. The role itself is a separate contract: Article 27 representative service.
The DPO question
The DPO Cockpit opens for public bodies, the § 38 BDSG chip or the DPO tier, and lists when a data protection officer (DPO) is mandatory under Art. 37(1), plus the Art. 39(1) tasks. The Art. 37–39 card also shows when the top tier is ‘Elevated · DPIA required’: a prompt, not a finding. A DPO is not a representative: EU representative vs DPO.
Trigger markers, WP248 screening and Art. 36 prior consultation: DPIA tool.
A US software vendor with three activities
A hypothetical company, not a client: a Delaware B2B software vendor with no office in the Union, European customers, US hosting and a newsletter. Quick check: personal data, Art. 27 and consent yes; Art. 9 and Art. 22 GDPR no.
- Customer workspace hosting · ProcessorChips ‘Third-country transfer’ and ‘Thousands of data subjects’. Tier: Special · third-country.
- Product newsletter · ControllerSector and chip ‘Direct marketing’. Tier: Standard duties.
- Sales CRM · ControllerNo chips. Tier: Standard duties.
Result: fifteen cards, Articles 5, 6, 7, 13/14, 15, 16–20, 21, 24/25, 28, 30, 32, 33–34, 35–36, 44–49 and 27 GDPR; the Third-Country Transfer cockpit opens. The DPIA Cockpit, with the records editor and clause matrix, stays closed although the Art. 35–36 card is listed: a property of the tool, not a finding.
No transfer assessment, no breach clock, no contract text
- Everything the twin produces (cards, ticks, JSON files) is a draft of your own self-assessment, not an assessment of your case.
- The inventory is not an Article 30 record. Art. 30(2) processor records are not modelled, and a mixed profile counts as controller.
- No transfer impact assessment or SCC module configurator (the cockpit’s footnote puts both on its backlog), no DPF list lookup; eight adequacy destinations, not all.
- No territorial-scope test: Article 3(2) is not modelled, and the Art. 27(2) exemption is a task, not a test.
- Tasks are titles, not templates; no breach clock, no access-request tracker, no contract text.
- German national law only: § 26, § 29 and § 38 BDSG. The § 26 card does not reflect CJEU C-34/21, which calls § 26(1) sentence 1 BDSG into question.
- Exports are JSON, from three DPIA sub-cockpits; a DOCX report needs a deep-analysis engine outside this browser edition. Cross-regime applicability statements belong to the obligations register.
Frequently asked questions
Does GDPR apply to US companies?
It can; incorporation does not decide it. Article 3(2) GDPR reaches processing relating to offering goods or services to people in the Union, or monitoring their behaviour there, by a company without an EU establishment; citizenship plays no role. Whether your site meets that test is a legal assessment the law firm Theo Funk can make under a separate mandate.
Do we need a record of processing activities under Article 30?
In most cases, yes. Article 30(5) GDPR spares organisations with fewer than 250 employees only if their processing is occasional, unlikely to result in a risk and involves no Art. 9 or Art. 10 data. A Commission proposal to widen that exemption was still pending on 27 September 2026.
What must a data processing agreement contain under Article 28?
Article 28(3) GDPR requires a contract setting out the subject-matter and duration, nature and purpose, types of personal data and categories of data subjects, and the controller’s obligations and rights. It adds eight processor duties: documented instructions, confidentiality, Article 32 security, sub-processor conditions, help with data-subject requests and with Articles 32 to 36, deletion or return, information and audits. The twin’s clause matrix, open only with the DPIA Cockpit, records a status you set per duty; it writes no contract text.
Do I still need SCCs if my US vendor is DPF-certified?
Not for a transfer from the EU directly to that vendor, if its certification is active and covers the data concerned; HR data needs HR coverage. If the data reaches you in the US first, the certification alone does not settle your onward step; ask counsel. The framework, adequacy decision (EU) 2023/1795 under Article 45 GDPR, was upheld by the General Court on 3 September 2025 (T-553/23, Latombe); an appeal was pending at the Court of Justice on 27 September 2026.
Do I need a DPO under the GDPR?
When Article 37(1) GDPR or national law under Article 37(4) requires one. Article 37(1) covers public authorities, core activities of large-scale regular and systematic monitoring of people, and core activities of large-scale Art. 9 or Art. 10 processing. Germany adds cases in § 38 BDSG. The twin lists the triggers; it does not test scale or core activities.
Can the GDPR twin tell us whether we need an Article 27 representative?
It flags the duty; it does not decide it. Only a ‘Yes’ to the quick-check establishment question adds the Art. 27 card and its four tasks. Whether Article 3(2) reaches you and the Art. 27(2) exemption fits is a legal question; the Article 27 representative service page covers who must appoint.
Scope, exemption, transfer: three calls it leaves open
The twin lists Article 27 and Chapter V; it cannot say whether your site targets people in the Union under Article 3(2), whether the Art. 27(2) exemption fits, or whether a transfer instrument holds for a vendor. Under a separate mandate, the law firm Theo Funk can assess them, starting from the records draft and clause statuses you recorded here.
If you need a representative, Regingada UG (haftungsbeschränkt) holds the role under its own contract: established in Germany, it is the address for authorities and data subjects (Art. 27(4)), fitting where some of the people concerned are in Germany (Art. 27(3)); no legal advice. Appointments go through the Article 27 representative service, not the suite. Fees are on the price list; other regimes on representation for US companies.