Glossary · Security and compliance
GDPR
Also called General Data Protection Regulation, UK GDPR
Definition
The General Data Protection Regulation (GDPR) is the EU's data protection law, in force since May 2018, with a UK version after Brexit. Data rooms often hold personal data, such as employee files and customer records, so sellers need a lawful basis to share it and often redact it before disclosure.
Where GDPR comes up
On this site, in our guides and in the conversations we've written up.
Guide Virtual data room security: what to look for Look for independent, audited certifications rather than self-assessed claims: ISO 27001 (information security management), SOC 2 Type II (operational controls over time), and where relevant ISO 27017/27701, SOC 3, HIPAA and GDPR alignment. Guide iDeals VDR review: easy to use, secure and quick to set up iDeals also complies with the major standards, including GDPR and SOC 2, and holds several ISO certifications. Guide Admincontrol VDR review: a data room you can start straight away Being based in Europe, it also has a strong connection to GDPR. Guide Drooms VDR review: European data sovereignty, with a few caveats It places considerable emphasis on GDPR compliance, which makes it an attractive option for European organisations dealing with confidential financial or commercial information. Use case Best virtual data room for real estate Cross-border European deals must square with GDPR; a provider that keeps data (and AI processing) in the EU is easier to comply with. 
Podcast · Real Asset Media Thought Leaders Drooms CEO on longer deals, data sovereignty and running AI in-house Drooms CEO and co-founder Alexandre Grellier on why M&A deals now take over a year to close, why digital sovereignty (where data lives and who owns it) has become a defining issue under GDPR, and why Drooms runs its own large language… 
Podcast · Life with GDPR Due diligence in M&A for data protection and GDPR Jonathan Armstrong and Tom Fox discuss data privacy, data protection and GDPR in the context of M&A due diligence. 
Video · VirtualData-Room.com Admincontrol review: a data room you can start straight away Granular permissions, multi-factor authentication, encryption and GDPR credentials
AI search, structured Q&A, engagement insights and deal management tools
Power users and global deals may want more advanced customisation
Do you remember… 
Video · VirtualData-Room.com Drooms review: European data sovereignty, with a few caveats James Dean on Drooms, as quickly as he can: a straightforward setup, strong security with European data centres and GDPR, an interesting but not quite finished AI, and a user experience that experienced deal teams like more than occasional… 
Video · VirtualData-Room.com iDeals review: as good as its name? iDeals also complies with the major standards, including GDPR and SOC 2, with multiple ISO certifications there to show you that it's a secure platform.
Podcast · Real Asset Media Thought Leaders Drooms CEO on longer deals, data sovereignty and running AI in-house Drooms CEO and co-founder Alexandre Grellier on why M&A deals now take over a year to close, why digital sovereignty (where data lives and who owns it) has become a defining issue under GDPR, and why Drooms runs its own large language… Podcast · Life with GDPR Due diligence in M&A for data protection and GDPR Jonathan Armstrong and Tom Fox discuss data privacy, data protection and GDPR in the context of M&A due diligence. Video · VirtualData-Room.com Admincontrol review: a data room you can start straight away Granular permissions, multi-factor authentication, encryption and GDPR credentials
AI search, structured Q&A, engagement insights and deal management tools
Power users and global deals may want more advanced customisation
Do you remember… Video · VirtualData-Room.com Drooms review: European data sovereignty, with a few caveats James Dean on Drooms, as quickly as he can: a straightforward setup, strong security with European data centres and GDPR, an interesting but not quite finished AI, and a user experience that experienced deal teams like more than occasional… Video · VirtualData-Room.com iDeals review: as good as its name? iDeals also complies with the major standards, including GDPR and SOC 2, with multiple ISO certifications there to show you that it's a secure platform. Related terms
Redaction Blacking out sensitive parts of a document, such as names or prices, before others can see it. Data residency Where a provider physically stores your data, which can matter for regulation and client requirements. ISO 27001 The international standard for information security management, certified by independent auditors. Single sign-on Logging in with a company account, such as Microsoft or Okta, instead of a separate password. SOC 2 An independent audit report on a service provider's security controls, common in the US. Two-factor authentication A login that needs a second proof of identity, such as a code on a phone, on top of a password.