Privacy & Compliance 2026

GDPR Compliance in RFPs (2026): Schrems II, EU AI Act & Data Residency

Practical 2026 guide to answering GDPR, Schrems II, and EU AI Act questions in RFPs. Includes ready-to-paste language for data residency, data subject rights, EU privacy contacts, and EU AI Act readiness.

Last updated May 2026

What is GDPR?

The General Data Protection Regulation (GDPR) is the EU privacy law that governs how organizations collect, process, store, and delete personal data of EU residents. It applies to any organization processing EU personal data, regardless of where the organization is located.

Key GDPR principles

Lawfulness & transparency

Process data lawfully with clear privacy notices.

Purpose limitation

Use data only for stated purposes.

Data minimization

Collect only necessary data.

Data subject rights

Right to access, portability, erasure, rectification.

Schrems II: what RFP buyers actually ask in 2026

Since the Schrems II ruling invalidated the EU–US Privacy Shield, EU buyers expect specific answers about how you transfer personal data outside the EU. The default mechanism is Standard Contractual Clauses (SCCs); EU-resident processing avoids the transfer question entirely.

Example response — EU-resident vendor (e.g. RFP.ai):

"Personal data of EU customers is processed and stored in the EU. We do not transfer EU personal data outside the EU as part of standard service delivery, which avoids Schrems II SCC requirements for our EU customers' data plane."

Example response — US-hosted vendor with SCCs:

"Personal data may be transferred to the United States. We use the European Commission's Standard Contractual Clauses (SCCs) and supplementary measures including encryption at rest and in transit, role-based access controls, and a documented transfer impact assessment."

EU AI Act readiness in RFP responses

EU AI Act compliance is increasingly an RFP question for any vendor offering AI-driven features. Buyers want to know your risk classification, transparency posture, and governance approach — not implementation detail.

Risk classification
Identify whether your AI features fall into prohibited, high-risk, limited-risk, or minimal-risk categories under the EU AI Act.
Transparency & explainability
Document how AI outputs are surfaced to users (e.g. cited answers, confidence scores) so buyers can confirm transparency requirements are met.
Human oversight
Reference your reviewer/approval workflows; AI Act Article 14 expects meaningful human oversight on outputs that affect users.
Logging & traceability
Describe how AI inputs/outputs are logged for audit (e.g. citation history, confidence-score history, reviewer decisions).

Common GDPR questions in RFPs

"Are you GDPR compliant?"

How to answer: Describe your privacy program, privacy contact or DPO (if required), and key safeguards.

Example: "We maintain documented privacy policies, data processing agreements, and technical and organizational measures designed to support GDPR obligations. We keep records of processing activities and provide a privacy contact for data protection inquiries."

"How do you handle data subject rights requests?"

How to answer: Explain your process for handling access, deletion, portability, and rectification requests within GDPR's 30-day timeframe.

"Where is EU personal data stored?"

How to answer: Specify data residency (EU-based or with Standard Contractual Clauses for transfers outside EU). Be explicit about whether your primary data plane is EU-resident.

"Are you ready for the EU AI Act?"

How to answer: Reference your risk classification, transparency posture (citations, confidence), human-oversight workflows, and audit logging. Be specific about which Article 14 (oversight) and Article 13 (transparency) obligations your product supports.

Best practices

Reference your privacy contact
If you have a Data Protection Officer, mention them. Otherwise provide a clear privacy contact for data protection questions.
Explain data subject rights
Detail how customers can exercise rights (access, deletion, portability, rectification).
Clarify data location and Schrems II posture
Be explicit about where EU data is stored, whether it leaves the EU, and which transfer mechanism applies (SCCs, EU-resident processing, etc.).
Pre-write EU AI Act language
Include your AI risk classification, transparency surface, and human-oversight workflow as approved content blocks so reviewers don't have to draft on the fly.