GDPR compliance

We ensure that personal data protection processes comply with GDPR requirements

We help businesses assess data protection and implement necessary measures to comply with European privacy rules. We conduct an audit and develop a plan: from updating policies to implementing response procedures.

What businesses need to know about GDPR

Applies outside the EU

If your product or service processes personal data of EU citizens, it automatically falls under GDPR requirements. The Regulation applies outside the EU, so even Ukrainian or international services must ensure compliance

Fines for GDPR violations

GDPR allows fines of up to €20 million or up to 4% of a company’s global annual turnover, whichever is higher. But even “smaller” fines of €5,000–€50,000 can be a serious blow for small and medium-sized businesses.

Stronger GDPR enforcement

In 2024–2025, EU regulators have become more active and impose fines not only on large players but also on small and medium-sized companies for poorly drafted policies, lack of consent, excessive data collection, or technical errors in processing.

Stages of the GDPR compliance process

conducting an audit

We analyze what personal data your company collects and stores, assess risks, and evaluate the current level of compliance with the rgulation.

remediation plan

We provide a detailed action plan to eliminate the identified shortcomings: which processes to change and which documents to revise.

implementation of changes

We update the Privacy Policy, Terms of Use, conclude data processing agreements with partners, and implement procedures for handling data subject requests.

training and support

We conduct training for your team on new data handling rules and provide ongoing legal support on privacy matters.

Top 5 misconceptions about GDPR

Помилка

Факт

Помилка

GDPR does not apply if the company is not in the EU

Факт

✓

What matters is not where you are registered, but who you work with. If you:

sell goods or services to customers in the EU;
have a website with delivery to Europe;
use analytics that track the behavior of users from the EU, then GDPR may also apply to you

Помилка

You can copy other companies’ policies

Факт

✓

The Privacy Policy must reflect the actual data processing activities in your company. Copying means non-compliance with actual practices.

Помилка

No need to obtain consent for data collection

Факт

✓

GDPR requires a legal basis for each processing activity. A complete absence of a legal basis is a direct violation of the regulation.

Помилка

It is safer to write in very legal language

Факт

✓

GDPR requires clear and plain language (the transparency principle). Overly complex language is a violation of the duty to inform.

Помилка

You can collect excessive data without risks

Факт

✓

This violates the data minimization principle (Article 5 GDPR). Only data necessary for a specific purpose may be collected.

Client reviews

The lawyers at Barbashyn Law Firm made a professional contribution to the legal structuring of our service, which uses artificial intelligence technologies and processes users’ personal data. The team helped us set up the правильну model of data processing and prepare the necessary documentation for the website and the service.

Zuvu (Softimization Technology)

Viktor Bovallius, Founder

The Barbashyn Law Firm team helped us address the legal aspects of interaction with players in our video game, in particular regarding personal data processing, the agreement, and the rules of user interaction within the game. We value the team’s professional approach and expertise.

GTA Ukraine

Hryhorii and Alyona, Co-founders

The Barbashyn Law Firm legal team helped us set up the legal model of the platform and refine the agreements for the website. In particular, they structured not only the interaction with users of the service but also with producers and authors who grant licenses for the use of audio files.