EHS Insight and The General Data Protection Regulation (GDPR)

Last modified: March 27, 2026

EHS Insight offers a GDPR-compliant Data Processing Agreement (DPA), which enables customers to comply with GDPR contractual obligations. The EHS Insight DPA is incorporated into the EHS Insight Terms of Service and applies automatically to all customers globally who require it to comply with the GDPR.

What Is the GDPR Anyway?

The General Data Protection Regulation, better known as the GDPR, is a comprehensive data privacy law enacted by the European Union that took effect in May 2018. At its core, the GDPR establishes clear rules about how organizations collect, store, process, and share the personal data of individuals located in the EU. It grants people meaningful rights over their own information, including the right to access it, correct it, and in some cases, have it deleted entirely. For businesses, it sets out specific obligations around transparency, data security, and accountability, backed by significant financial penalties for non-compliance. In short, the GDPR transformed personal data from something companies could freely exploit into something they must actively protect.

What Was It Like Before the GDPR?

Before the GDPR, data privacy in Europe was governed by a patchwork of national laws based on a 1995 EU Directive, a framework that was written long before smartphones, cloud computing, or social media existed. Each member state interpreted and enforced the rules differently, creating an uneven landscape that was difficult for multinational organizations to navigate and easy for bad actors to exploit. Consumers had limited visibility into how their data was being used, and enforcement was inconsistent at best. Organizations could collect vast amounts of personal information with vague justifications, retain it indefinitely, and share it broadly — often without users ever knowing. The GDPR was designed to close those gaps, modernize the rules for a digital-first world, and bring meaningful, consistent protection to individuals across all EU member states.

Does the GDPR Apply to Me?

If your organization collects, processes, or stores personal data belonging to individuals in the European Union, regardless of where your company is based, the GDPR likely applies to you. This is one of the regulation's most important features: its reach extends well beyond European borders. A SaaS company headquartered in Texas that serves customers or employees in the EU, for example, must still meet GDPR requirements. For EHS professionals, this is particularly relevant when managing employee health records, incident reports, safety training data, or any other personally identifiable information tied to workers in EU countries. If you're unsure whether your data practices fall under GDPR jurisdiction, it's worth consulting with a qualified legal or compliance advisor and ensuring that the software tools you rely on are built with data privacy as a foundation, not an afterthought.

When it comes to the data in EHS Insight, review our updated Terms of Service and Privacy Policy. When you accept EHS Insight’s Terms of Service, you are acknowledging that your use of EHS Insight will be compliant with all applicable laws, including the GDPR.

Also, please review our list of sub-processors.

Sign up here to receive notifications changes to our DPA or sub-processors.