GDPR compliance check and certification
If you sell to people in the European Union, or track what they do online, the EU’s General Data Protection Regulation (GDPR) can apply to you from Singapore. We check where you stand against it and prepare you for certification. An independent certification body audits you and issues the certificate.
Does the GDPR apply to you?
- You offer goods or services to people in the EU, paid or free.
- You monitor the behaviour of people in the EU, for example by tracking them online.
- An EU client asks you to sign data protection terms as their vendor.
If the GDPR applies to you directly, you usually also need a representative in the EU. Fines can reach EUR 20 million or 4% of worldwide annual turnover, whichever is higher.
Source: GDPR (Regulation (EU) 2016/679), Articles 3(2), 27, 28 and 83(5), read 13 October 2026.
What you get
- A GDPR compliance check: where you stand against each obligation that applies to you, in a written report ranked by risk.
- A plan to close the gaps: policies, privacy notices, records of processing, data transfer terms and breach steps.
- Your PDPA work mapped once against the GDPR, so the evidence you share between the two is prepared once.
- Evidence prepared to the criteria the certification body audits against, and support at the audit.
Certification under the GDPR
The GDPR lets an organisation show compliance through an approved certification. Certification is voluntary, and it does not reduce your duty to comply. Europrivacy was the first scheme approved by the European Data Protection Board as a European Data Protection Seal, valid across the EU. In April 2026 the Board approved a version that organisations outside the EU, subject to the GDPR, can use.
Source: GDPR Article 42; European Data Protection Board Opinion 28/2022 (October 2022) and Opinion 14/2026 (adopted 15 April 2026), read 13 October 2026.
Common questions
Do you certify us?
No. We prepare you; an independent certification body audits you against the scheme’s criteria and issues the certificate.
We already comply with the PDPA. Is that enough for the GDPR?
Not on its own. The two laws overlap, but the GDPR asks for things the PDPA does not, such as records of processing activities, a right to have personal data erased and, for many organisations outside the EU, a representative in the EU. The check shows the difference for your organisation.
Can we prepare for GDPR certification and ISO/IEC 27701 together?
Often, yes. Both cover how you manage personal data, so much of the evidence overlaps. We plan the shared evidence once.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)