Quick answer
GDPR compliance is not a policy document — it is proof that you know what happens to personal data on every endpoint that touches it. Most companies can describe their privacy rules but cannot produce the logs a regulator actually asks for.
- European regulators issued €1.2 billion in GDPR fines in 2025 alone, and €7.1 billion since the law took effect in 2018
- Malicious insider incidents now cost $4.92 million on average — the single most expensive breach category
- The gap most IT teams miss: visibility into data after it reaches an employee’s device, not before
A company that says “we are GDPR compliant” usually means it has a privacy policy on file.
GDPR does not ask for a policy. It asks for evidence.
Evidence of which employee could access a given piece of personal data, when, from which device, and what they did with it afterward.
Most companies cannot produce that trail for a single laptop, let alone the whole fleet.
The gap stays invisible until a regulator, a customer, or a breach asks for it — and by then it is too late to build the evidence retroactively.
The compliance gap nobody budgets for
Legal teams write the policy. IT teams are supposed to enforce it. In practice, enforcement usually stops at the firewall and the VPN — the perimeter, not the endpoint where the data actually sits.
That split is where the numbers below come from.
Why endpoint data is so hard to account for
Personal data does not stay in one system. It moves — into spreadsheets, downloads, screenshots, personal cloud drives. Each move is a copy the original access log never mentions.
| Data category | Common endpoint location | Visible to IT today? | What GDPR expects |
|---|---|---|---|
| Customer records exported to spreadsheets | Local disk, downloads folder | Rarely | Access log, retention limit, deletion on request |
| HR files on former employees | Shared drives, old laptops | Sometimes | Proof access was revoked at offboarding |
| Screenshots and exports of dashboards | Desktop, email attachments | Almost never | Same protection as the source data |
| Data synced to personal cloud accounts | Browser, sync clients | Rarely | Documented transfer control |
What stays invisible
Copies nobody tracked
A spreadsheet exported once, three years ago, by someone who left the company, can still be sitting on a laptop that never got wiped. GDPR does not care that it was an accident.
Access nobody revoked
Role changes and offboardings are the moments access reviews are supposed to happen. Without an automatic record, “we revoked it” is a claim, not evidence.
A regulator does not ask what your policy says. It asks for the log that shows the policy was followed on a specific device, on a specific date. If that log does not exist, the policy might as well not exist either.
“Companies need to stay alert to what is accessed on their equipment, by whom, and what security measures apply to that data. Having that visibility, with clear indicators instead of guesswork, is what turns a policy into something you can actually manage,” says Carine Randt, INGITE specialist certified in ISO/IEC 27001.
A policy protects you on paper. A log protects you in an audit.
It is not a people problem, it is a visibility problem
Most GDPR incidents are not malicious. They are a well-meaning employee moving data to get a job done faster, without knowing the compliance consequence.
Blaming the employee does not close the gap. Seeing the movement as it happens does.
Closing the gap, in four steps
- Mapevery device and account that can touch personal data, not just the systems where it is stored by design.
- Classifywhat counts as personal data under GDPR on each endpoint — exports, copies and screenshots included.
- Monitor and alerton the moment data moves somewhere it should not, instead of finding out during an audit.
- Prove itby being able to export the access and activity log for any device, on demand, without a scramble.
An audit-ready log is only useful if it is tamper-evident and tied to the device, not just the user account — shared logins and cached credentials are exactly what make self-reported compliance fall apart under scrutiny.
How INGITE helps
Cloud EndPoint Security
Turns the policy into enforcement: access events, security policies and alerts recorded at the device level, so “we protect personal data” has a log behind it.
Cloud Digital Forensics Investigation
When a regulator or a breach forces the question, this is what lets you reconstruct exactly what happened on a device — with evidence that holds up, not a best guess.
Could you produce the evidence tomorrow?
Not the policy. The log.
- If a regulator asked today, could you show who accessed a specific customer’s data in the last 90 days?
- Do you have proof that access was revoked the day an employee left, not “around” that day?
- Could you tell whether personal data was copied to a personal device this week?
- If the answer to any of these is “probably,” is the risk really the employee, or the visibility you don’t have?
If the honest answer is no, the problem was never the policy. It was never being able to see what the policy was supposed to control.
What does GDPR actually require companies to do with employee-handled data?
How can IT teams prove GDPR compliance during an audit?
What is the average cost of a GDPR-related data breach in 2025?
How does endpoint monitoring support GDPR compliance?
Make GDPR compliance provable, not just written down
Cloud EndPoint Security gives your team the access and activity log a regulator actually asks for.