GDPR Compliance at myLaminin
What is GDPR?
The GDPR is a comprehensive data protection law enacted by the European Union. It governs how organizations collect, process, store and transfer the personal data of individuals in the EU and EEA.
The regulation has two aims: to give individuals more control over their personal data, and to harmonize data privacy law across Europe.
Examples of personal data
Personal data is any data that can be linked to an identifiable person, including:
Name, email address and phone number
IP address and location data
Health records
Identifiers such as user IDs
Key aspects of GDPR
Scope
GDPR applies to every organization that processes personal data of individuals in the EU, wherever the organization is based. That includes data controllers and data processors outside the EU if they offer goods or services to EU data subjects or monitor their behavior.
Purpose
GDPR protects the fundamental rights and freedoms of individuals, especially their right to privacy. It sets strict rules for handling personal data and gives individuals greater transparency and control over their own information.
Compliance requirements
Organizations must put appropriate technical and organizational measures in place. These rest on principles such as data minimization, purpose limitation, storage limitation, transparency and accountability. Key areas include:
Assessment and penalties
Compliance may be assessed through internal audits, external legal reviews and investigations by Data Protection Authorities (DPAs). Noncompliance can lead to administrative fines of up to €20 million or 4% of global annual turnover, whichever is higher.
myLaminin's compliance with GDPR
A lawful basis for processing
Data subject rights: access, correction, deletion and portability
Consent management
Security of processing
Data protection impact assessments (DPIAs)
Data breach notification
myLaminin has conducted a comprehensive review of its platform to evaluate compliance with GDPR, in its role as a data processor supporting research and data collaboration across academic and healthcare environments. Our internal assessment sorts the requirements into three groups.
71%: supported directly by the platform
Based on our internal assessment, myLaminin currently supports 71% of GDPR requirements directly through platform capabilities, technical controls and organizational policies. These include:
17%: the Principal Investigator's responsibility
17% of the requirements are tagged as the Principal Investigator's (PI's) responsibility. These mainly cover the legal basis for data collection, participant consent and fulfillment of data subject requests.
This is because myLaminin does not exercise direct control over research processes or participant engagement. Instead, we give researchers the tools to run their own data collection workflows, including customizable consent mechanisms and data minimization practices.
9%: on our product roadmap
The remaining 9% of requirements are on our product roadmap. Targeted improvements aim to enhance data portability, automated consent verification and self-service data access for participants. We have prioritized these features to further strengthen the platform's data protection alignment and support for researchers.
See it for yourself
Want to see how myLaminin's access controls, audit logging and consent tools fit your research workflow?