Personal data that stays lawful, secure and under your control
The GDPR demands lawful, transparent and accountable processing of personal data. Scrydon gives you residency, encryption, key control and audit by design — so privacy is enforced by the architecture your data already runs on.
General Data Protection Regulation (GDPR)
The General Data Protection Regulation (Regulation (EU) 2016/679) governs how personal data of people in the EU/EEA is processed. It is built on principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. It grants individuals rights — including access, rectification, erasure, restriction, portability and objection — requires appropriate technical and organisational security measures, restricts international transfers, and can impose fines of up to 4% of global annual turnover.
- Jurisdiction
- European Union / EEA
- Applies to
- Any organisation that processes the personal data of people in the EU/EEA, whether established in the Union or offering goods, services or monitoring from outside it.
How Scrydon helps you comply
Controls are built into the runtime, so compliance is something you can demonstrate with evidence drawn from the platform itself — not assembled after the fact.
Data residency and sovereignty
You choose where data lives and is processed, with self-hosted and sovereign deployment options. This makes data residency and international-transfer controls a deployment decision rather than a hope, helping you keep personal data within your chosen jurisdiction and lawful basis.
Encryption and key strategy
Secrets and data are protected with LOCAL, BYOK and HYOK key strategies, so you can hold your own keys (BYOK) or keep them entirely in your own custody (HYOK). Combined with an mTLS service mesh, this delivers the integrity and confidentiality measures the GDPR's security principle requires.
DLP and data minimisation
The DLP guardrails engine detects and can redact personal data in model inputs and outputs, supporting data minimisation and preventing inadvertent disclosure of personal data through AI features. Document clearance and classification keep sensitive records away from contexts where they should not appear.
Audit log and accountability
An immutable, queryable audit log records who accessed what, when and from where, with redaction and retention controls. This evidences the accountability principle and helps you respond to data-subject requests, demonstrate lawful access and investigate incidents.
Access control and data-subject rights
Three-tier access control — organisation roles, workspace membership and team grants — enforces least privilege over personal data. Granular, auditable access makes it practical to honour rights of access, rectification and erasure and to limit processing to those who genuinely need it.
What GDPR asks of you
- Establish a valid lawful basis for every processing activity.
- Apply data protection by design and by default.
- Practise purpose limitation, data minimisation and storage limitation.
- Implement appropriate technical and organisational security measures.
- Enable data-subject rights such as access, rectification and erasure.
- Control international transfers and keep records of processing activities.
- Detect, document and, where required, report personal-data breaches.