questions:
  - question: Who is impacted by GDPR? 
    answer: |
      Any entity that does business with corporations or individuals in the European Union and will have access to personal data.
  - question: When did the law go into effect? 
    answer: May 25, 2018
  - question: Is GitLab GDPR compliant?
    answer: |
      Yes, compliance is an ongoing process and we work diligently to keep up with best practices and processes every day. 
  - question: What is the difference between a controller and processor? 
    answer: |
      Controllers determine how personal data is processed and used. Processors simply process the data as prescribed by the controller.
  - question: What is the supervisory authority?
    answer: |
      The supervisory authority is the United Kingdom's Information Commissioner’s Office (ICO). The independent regulatory office is a public body that reports to Parliament. The ICO is tasked with "uphold[ing] information rights in the public interest, promoting openness by public bodies and data privacy for individuals," according to the authority’s website.
  - question: What are the principles of Privacy by Design and Privacy by Default?
    answer: |
      Privacy by design occurs when data protection is embedded into each step of the personal information processing life cycle, including processing product development, software development, and IT systems. Privacy by default means that the strictest privacy settings are automatically in place when an application is released to the public.
  - question: Who should be in control of ensuring GDPR compliance at my company?
    answer: |
      Companies should designate an employee to oversee GDPR compliance and determine where that responsibility will fall within the organization, i.e. security department. Some companies will be required to hire or designate a data protection officer to oversee GDPR compliance within their organization. 
  - question: What is a Data Protection Officer?
    answer: |
      GDPR calls for some companies to designate a Data Protection Officer (DPO) depending on the nature and amount of personal data the entity processes. The officer, who must be an expert in data protection law, will be tasked with establishing and maintaining a data security plan and GDPR compliance. DPOs are required for public entities as well as companies that manage or store large amounts of personal data, process or hold special personal information or routinely monitor the personal data of private individuals.   
  - question: Does using GitLab make my company GDPR compliant?
    answer: |
      No, GitLab is a processor of information. While GitLab continuously works towards maintaining GDPR compliance, simply using GitLab’s services does not make your company compliant. As the controller of the information, you must ensure that the collection of personal data is GDPR compliant as well as other processors in your pipeline.  
  - question: What happens if my company is not GDPR compliant?
    answer: |
      Breaches in GDPR compliance can range from a stern, written warning for first-time, unintentional infractions to a fine of €20 million or 4 percent of the company’s previous year’s total global revenue, whichever is greater.  
