Definition
GDPR (the General Data Protection Regulation) governs any processing of personal data in the European Union. Applied to a business tool, it translates into design choices: collect only what is necessary, define who accesses what, log access, set retention periods, allow people to exercise their rights, and bind by contract every provider that touches the data.
It comes on top of the rules of your own profession (professional secrecy, ethics) and, more recently, of the European AI Act when the tool embeds agents or models.
Why it matters to a business owner
For a business owner, a business tool's GDPR compliance is first a matter of responsibility: the company answers for the data it processes, including at its providers. It then weighs commercially, because large accounts and regulated professions check these points before signing.
A tool designed with these rules from the start costs less than a tool brought into compliance afterwards, when the data model and the access rights have to be reworked.
What Stratedge Consulting does
The tools the agency builds include partitioned access, logging, rights per file and per role, and hosting in Europe. The same foundation serves the tools of professions bound by professional secrecy. Your data is never used to train a model. See the Advisory, strategy and compliance page.
For AI usage, the AI compliance pack, at €3,500 excl. VAT, inventories your uses, qualifies them by risk level under the European AI Act, and delivers the register, the charter and the transparency notices. Delivered websites include consent, and audience measurement can be cookieless when that suits better.
Common mistakes
Treating GDPR as a cookie banner. The substance lies in the data model, the access rights and the contracts with processors.
Pasting an identifiable client file into a consumer AI tool. A business tool goes through plans that do not reuse the data and known hosting, with a written framework for the teams.