GDPR compliance for SME platform.
General Data Protection Regulation (Regulation (EU) 2016/679). Enforced from 2018-05-25. Supervised by EDPB + national supervisory authorities (CNIL, BfDI, ICO etc.). Coreal generates the evidence pack automatically on every Minctrl build — see /security-compliance for the full posture.
What this regulation covers.
Personal data processing, DPIA, breach notification, data-subject rights.
For a SME platform, the salient angles are: Merchant onboarding KYB (beneficial ownership, ML risk); Sub-merchant aggregation under acquiring rules; Tier-2 sanctions screening per merchant + transaction. Primary licence: PI for payment services; partner-acquirer for cards.
- Art. 5 — Principles relating to processing
- Art. 25 — Data protection by design and by default
- Art. 32 — Security of processing
- Art. 33 — Breach notification (72 hours)
- Art. 35 — DPIA
What lands in the regulator file.
All items journaled, replayable, 7-year retention.
Which GDPR articles apply to a sme?
Primarily: Art. 5 — Principles relating to processing; Art. 25 — Data protection by design and by default; Art. 32 — Security of processing. The full mapping is in the Coreal compliance posture document — see /security-compliance.
What evidence does Coreal generate per audit?
Record of Processing Activities (RoPA); DPIA per high-risk processing (e.g. crypto, biometric); Breach register + 72-hour notification log. The Minctrl pipeline produces this artefact set automatically on every build — see /company §05 'How we ship'.
What are the penalties for non-compliance?
Up to €20M or 4% of annual global turnover, whichever is higher.
Bring the perimeter,
leave with a brief.
Read the Wave-1 runbook first.
The full 90-day launch sequence — phases, partner-bank gates, who signs off when. No form to read it.
Read the runbook →INDICATIVE DATA · Numbers and timelines reflect public regulator filings, vendor documentation and our own delivery experience. Per-engagement values vary with operator profile, BSS vintage and regulatory perimeter. Engage early for a fitted estimate under NDA.