The rules for any business in the EU and the EEA

What the law says

The GDPR applies directly in every EU member state, and in Norway and Iceland through the EEA Agreement. Each country adds its own national rules and names its own supervisory authority. If personal data is breached, the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put people at risk (art. 33).

What Fundarem does

You are the controller of your data. Where we operate or support your installation, we are your processor, under a written data processing agreement (art. 28). Under that agreement we tell you about a breach without undue delay, and within 72 hours at the latest, with what we know, and we help with the notice. You decide on notifying your supervisory authority.

What the law says

The AI Act sets rules for AI systems in the EU and phases in from 2025. EU member states apply it directly as an EU regulation; in Norway and Iceland it applies once it is taken into the EEA Agreement and national law.

What Fundarem does

Fundarem is a general-purpose integration tool, not built or marketed for any high-risk use. Every action an agent proposes is labelled and logged, and write control is set per action by your admin. Planning a high-risk use, such as ranking job applicants? Tell us first.

What the law says

In its Schrems II judgment of 16 July 2020 the EU Court of Justice ruled that personal data sent out of the EU must keep a level of protection essentially equivalent to the one in the EU. It declared the EU–US Privacy Shield invalid and found standard contractual clauses valid, but the controller or processor that relies on them must verify, case by case, that the receiving country's law gives that protection, add safeguards where needed, and otherwise suspend or end the transfer.

What Fundarem does

The product is designed to run in your own Azure tenant, in an EU/EEA region you choose, and to keep all stored data there; it is designed so that we do not transfer stored data outside the EU/EEA. The model you choose decides where a prompt is processed: with the default model, the prompt, with columns tagged for masking replaced by placeholders, is processed outside the EU/EEA; an EU model processes it only within the EU, and a self-hosted model in your own region. Any future transfer outside the EU/EEA needs your instruction and a GDPR Chapter V safeguard: an adequacy decision or standard contractual clauses.

What the law says

NIS2 applies to entities of the types its annexes list, in sectors such as energy, transport, health, digital infrastructure, manufacturing and digital providers, that are medium-sized or larger, and to some whatever their size (art. 2). They take cybersecurity risk-management measures (art. 21) and report a significant incident in three stages: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month (art. 23). As a directive it applies through each country's own law, so whether it covers your business depends on that law.

What Fundarem does

Fundarem does not decide whether NIS2 applies to you, and our documents only summarise what it says. Where it applies, its duties, such as managing cybersecurity risks and reporting significant incidents, are yours under your country's law. What the product records, in your own Azure tenant: an append-only history of every change to your data. It also audits every agent tool call: who, what, when and the outcome.