Global Minimum Tax under OECD Pillar 2: Key Rules and Country Specific Requirements

The OECD’s Pillar 2 global minimum tax framework marks a transformative step in international taxation, aimed at ensuring multinational enterprises pay a minimum tax rate of 15% on profits earned worldwide. This reform addresses base erosion and profit shifting, promoting fairer tax competition across jurisdictions. This blog unpacks the core mechanisms of OECD Pillar 2 and highlights specific implementation details for France, Australia, New Zealand, and Singapore, offering essential insights for multinational companies preparing for these changes. What is OECD Pillar 2 Global Minimum Tax? The OECD (Organisation for Economic Co-operation and Development) Pillar 2 framework is a major part of the international global minimum tax initiative, developed to address the tax challenges of a highly digitalised and globalised economy. Its purpose is to curb base erosion and profit shifting (BEPS) by reducing harmful tax competition between jurisdictions. Under OECD Pillar 2, large multinational enterprises (MNEs) must pay a minimum corporate tax rate of 15% on profits earned in each country where they operate. This applies regardless of where the company is headquartered. If a business operates in a jurisdiction with a corporate tax rate below the OECD Pillar 2 minimum tax rate of 15%, other countries where it has operations can impose a “top-up” tax to meet the threshold. For example, if profits are taxed at 10% in one country, another jurisdiction can add a 5% tax to reach the global minimum rate. Pillar 2 is one of two pillars in the OECD’s global tax reform: Pillar 1 reallocates taxing rights to reflect where business activities and profits occur. Pillar 2 enforces the minimum tax rate to prevent profit shifting to low-tax jurisdictions. How does the Global Minimum Tax Work? The OECD Pillar 2 rules are built around three core mechanisms designed to enforce the global minimum tax: Income Inclusion Rule (IIR) – If a multinational group’s effective tax rate (ETR) in any jurisdiction falls below the minimum 15%, the ultimate parent company must pay a top-up tax to bring the rate up to 15%. Undertaxed Profits Rule (UTPR) – This acts as a safeguard if the IIR is not applied. Under the UTPR, other group entities in different jurisdictions may be required to pay the top-up tax on low-taxed profits not covered by the IIR. Qualified Domestic Minimum Top-up Tax (QDMTT) – Many countries are introducing this domestic rule to keep taxing rights over low-taxed profits within their own jurisdiction. With a QDMTT, the country itself collects the additional tax, instead of it being paid to the parent entity’s country under the IIR or to another jurisdiction under the UTPR. How does the Global Minimum Tax Apply? The global minimum tax under OECD Pillar 2 generally applies to large multinational enterprise (MNE) groups with annual consolidated revenues of €750 million or more in at least two of the four preceding fiscal years. It covers both domestic and cross-border operations, ensuring that qualifying groups pay a minimum effective tax rate of 15% in every jurisdiction where they operate. Smaller businesses and purely domestic companies typically fall outside the scope, although local rules may still require compliance with certain reporting obligations. How the Effective Tax Rate is Calculated For all three rules, the calculation of the OECD Pillar 2 minimum tax rate uses a consistent approach. It blends current and deferred tax figures to determine the ETR, requiring a detailed understanding of both international tax principles and deferred tax accounting. Together, these rules ensure that multinational enterprises operating in the countries adopting Pillar 2 cannot shift profits to low-tax jurisdictions without meeting the global 15% minimum threshold. OECD Pillar 2 Effective Dates The OECD Pillar 2 global minimum tax is being implemented in stages, and timelines vary between jurisdictions. Most countries have chosen to introduce the Income Inclusion Rule (IIR) and the Qualified Domestic Minimum Top-up Tax (QDMTT) first, with some early adopters legislating for application from 1 January 2024 (for accounting periods beginning on or after 31 December 2023). Later in this blog, we provide specific implementation timelines and requirements for France, Australia, New Zealand, and Singapore. What is the Tax Rule Multilateral Instrument (STTR MLI)? Alongside the core OECD Pillar 2 rules, the Subject to Tax Rule Multilateral Instrument (STTR MLI) has been introduced to help implement the Pillar Two framework. This treaty-based rule allows source jurisdictions (the country where the payment originates) to impose additional tax on certain cross-border intragroup payments when those payments face a nominal corporate tax rate of less than 9% in the recipient’s jurisdiction. The STTR MLI is particularly designed to benefit developing countries, enabling them to better protect their tax base by ensuring that certain payments, such as interest, royalties, and service fees, are taxed at a fair level. A key feature of the STTR MLI is that it allows the STTR provisions to be incorporated directly into existing bilateral tax treaties without the need for lengthy renegotiations—provided that both treaty partners sign and ratify the instrument. Currently, the STTR MLI is open for signature, but it remains to be seen how many jurisdictions will choose to adopt it. How the Global Minimum Tax Impacts Companies The introduction of the OECD Pillar 2 global minimum tax represents a significant shift in international tax planning and compliance for large multinational enterprises. Companies operating in low-tax jurisdictions may face higher overall tax liabilities due to the top-up tax mechanism, which ensures profits are taxed at a minimum rate of 15% regardless of where they are booked. This change can influence how businesses structure their global operations, allocate profits, and choose investment locations. For many groups, it will require: Enhanced tax reporting and transparency to calculate the effective tax rate (ETR) for each jurisdiction. Adjustments to intra-group transactions and transfer pricing policies to avoid unintended top-up taxes. Greater alignment of tax and business strategies to ensure compliance without compromising competitiveness. Reporting Obligations Under OECD Pillar 2 in France Decree 2024-1126, effective from 6 December 2024, sets out detailed reporting requirements for companies in France

French Transfer Pricing Documentation Requirements

Proper documentation is a cornerstone of compliance with transfer pricing rules in France. For international businesses operating in or through France, understanding the legal obligations around documentation is essential to avoid significant penalties and ensure alignment with global standards. This blog explains what is transfer pricing documentation and the French transfer pricing documentation  requirements. What is transfer pricing documentation? Transfer pricing documentation is a set of records that multinational companies must prepare to justify the prices charged in transactions between related entities. It shows that these prices follow the arm’s length principle and comply with local and international tax rules, such as the OECD Transfer Pricing Guidelines. This documentation typically includes a master file, local file, and sometimes a country-by-country report, depending on the size and structure of the business. French Transfer Pricing Documentation Requirements Who Is Required to Prepare Transfer Pricing Documentation? Under Article L. 13 AA of the French Tax Procedure Code (FTPC), the obligation to maintain formal transfer pricing documentation applies to: French companies (or French permanent establishments of foreign enterprises) that have: Annual turnover (excluding tax) or total gross assets of at least €150 million, or Ownership—direct or indirect—of more than 50% of another company that meets the threshold above, or Are themselves more than 50% owned by a legal entity meeting the above condition, or Are part of a French tax-consolidated group that includes at least one entity satisfying any of the criteria above. These transfer pricing rules in France apply broadly, capturing both French multinationals and foreign businesses with substantial French operations. Lighter Requirements for Smaller Entities Entities that do not meet the thresholds under Article L. 13 AA may still be asked to provide transfer pricing information under Article L. 13 B of the FTPC. In such cases, the French Tax Administration (FTA) may request a simplified version of the documentation, often referred to as a “light” file. Companies typically have 60 to 90 days to respond. What Must Be Included in the Documentation? Companies subject to Article L. 13 AA must prepare and retain transfer pricing documentation that includes: A master file: providing an overview of the global operations of the multinational group. A local file: containing detailed information about the local entity’s intragroup transactions, functional analysis, and comparable. A reconciliation file: linking the applied transfer prices to the French statutory financial statements. The documentation must be available at the start of any tax audit and provided in electronic format. Mandatory Filing: Form 2257-SD French companies with annual turnover or gross assets of €50 million or more, or that own or are owned (directly or indirectly) by another company meeting this threshold, must submit Form 2257-SD. This annual transfer pricing return must be filed electronically within six months after filing the corporate income tax return. Country-by-Country Reporting (CbCR) In line with OECD BEPS Action 13 and EU law, France has implemented Country-by-Country Reporting rules: Applies to multinational groups with consolidated revenues exceeding €750 million. Effective for fiscal years beginning on or after January 1, 2016. Includes Public CbCR for certain businesses, increasing transparency and global comparability. Exemptions Exemptions from transfer pricing documentation and declaration requirements apply when cross-border intra-group transactions of a specific type do not exceed €100,000 during a given fiscal year. This threshold is calculated separately for each transaction type and does not allow for offsetting between revenues and expenses. What to know more about Transfer Pricing Requirements for International Businesses? Read our dedicated blog! In conclusion, transfer pricing documentation is essential for international businesses in France to demonstrate compliance with tax laws and avoid heavy penalties. By meeting the local requirements and aligning with OECD standards, companies can ensure transparency and reduce audit risks.

Transfer Pricing for International Business in France

Transfer pricing for international businesses is a crucial area of tax compliance that affects multinational companies operating across borders. For multinational companies in France, complying with transfer pricing rules in France is essential to avoid costly penalties and disputes. This blog provides an overview of key transfer pricing concepts, explains why transfer pricing is important, and summarizes the OECD transfer pricing methods that guide multinational businesses worldwide. What is Transfer Pricing? Transfer pricing refers to the pricing of transactions between related entities within a multinational group. These transactions can include goods, services, intellectual property, loans, or other intercompany dealings. For multinational companies operating in France, understanding transfer pricing is critical to ensure tax compliance and avoid penalties. France’s transfer pricing rules are closely aligned with the OECD Transfer Pricing Guidelines, which serve as a global standard for setting intercompany prices. Central to these rules is the arm’s length principle.  What is the arm’s length principle? This is a concept that requires related-party transactions to be priced as if the entities were unrelated and operating under market conditions. In simpler terms, multinational companies must structure their intra-group transactions in a way that reflects the price two independent businesses would agree upon in comparable circumstances. Transfer pricing in France is applicable to all French-resident companies and includes branches of foreign entities operating in the country. This means international businesses with a presence in France must ensure their pricing strategies meet French and OECD standards. Why is Transfer Pricing Important? Non-compliance can result in significant tax adjustments, penalties, and reputational risks. Companies are allowed to make year-end transfer pricing adjustments, provided they can fully justify them. However, the French tax authority does not permit retroactive offsets between different fiscal years or between separate group entities. Penalties of non-compliance with transfer pricing rules Failure to comply with transfer pricing documentation requirements in France can lead to severe financial penalties. French entities falling within the scope of Article L. 13 AA of the French Tax Procedure Code (FTPC) are required to prepare and maintain detailed documentation to justify their intercompany transactions. If this obligation is not met, the penalties imposed can be significant. For each audited year, the penalty is calculated as the higher of: 0.5% of the amount of intercompany transactions that were omitted or insufficiently documented, or 5% of the reassessed taxable base related to those transactions.In all cases, the minimum fine is €50,000 per audited year. In addition, if a company fails to respond adequately under Article L. 13 B of the FTPC, typically related to requests for information during a tax audit, it may face a fixed penalty of €10,000 per year. There are also specific penalties associated with failure to file the 2257-SD transfer pricing return: Missing the submission deadline results in a €150 fine. Inaccuracies or omissions in the return (excluding cases of force majeure) incur a fine of €15 per error, with total penalties ranging from a minimum of €60 to a maximum of €10,000. It’s important to note that when a tax audit reveals more than €100,000 in reassessed taxes and certain penalties apply, the French Tax Authority (FTA) is obligated to refer the matter to the public prosecutor, which may lead to legal proceedings beyond tax penalties. OECD Transfer Pricing Guidelines The OECD Transfer Pricing Guidelines serve as the international benchmark for applying the arm’s length principle in in intra-group transactions. They provide a structured framework for evaluating how related-party transactions should be priced, as if they had occurred between independent entities under comparable conditions. Central to the guidelines is the selection of an appropriate pricing method, tailored to each case’s circumstances, reliability of data, and comparability. These methods fall into two main categories: traditional transaction methods and transactional profit methods. Traditional Transaction Methods Comparable Uncontrolled Price Method This technique evaluates the price charged in a controlled transaction (between related entities) by comparing it to the price applied in a comparable uncontrolled transaction (between independent parties) under similar conditions. This method is considered reliable when one of the following criteria is satisfied: The transaction in the open market is not materially affected by any differences in the circumstances of the transaction or the characteristics of the parties involved. Reasonable adjustments can be made to account for those differences and eliminate their impact on pricing.   Due to its direct approach in determining the arm’s length price, the CUP method is widely regarded as one of the most commonly applied and reliable methods in transfer pricing analysis. Resale Price Method This is categorized as a one-sided method, primarily used when a product is purchased from a related party and then resold to an independent third party. The transfer price is determined by taking the resale price to the third party and subtracting a gross margin that reflects the functions performed, risks assumed, and assets used by the reseller. This margin should align with what an independent distributor would earn in a comparable transaction. Cost Plus Method CPM is often employed when evaluating transactions involving the provision of services or the supply of tangible property, especially when such services are complex and difficult to value. This method involves identifying all costs incurred by the service provider (including both direct and indirect costs) and then adding an appropriate markup. This markup reflects the profit that a comparable independent entity would earn for performing similar functions under similar conditions. Transactional Profit Methods Transactional New Margin Method TNMM evaluates whether the amount charged in a controlled transaction is at arm’s length by comparing the net profit margin relative to an appropriate financial indicator, such as sales, assets, or costs, earned in similar uncontrolled transactions. While TNMM is commonly used due to its flexibility and applicability in many scenarios, it tends to be less accurate in situations where both parties to a transaction make distinct and significant contributions, especially when those contributions involve unique intangibles or specialized functions. Transactional Profit Split Method TPSM aims to allocate the combined profits (or losses)

How to Stay Compliant with the EU AI Act

Artificial intelligence is transforming industries at an unprecedented pace, offering innovative solutions across healthcare, finance, education, and beyond. However, these advancements also bring risks, from unintentional bias and privacy breaches to systemic harm.   The EU AI Act provides the first comprehensive regulatory framework worldwide, ensuring that AI technologies are developed and deployed responsibly.  This blog provides with a summary for EU AI Act, timeline for implementation, and specifics for HRAIS, General Purpose AI Models and Foundation Models. Why Do We Need Laws on AI? As AI technologies become increasingly powerful and widespread, they bring both tremendous opportunities and significant risks. Without clear regulations, AI systems could be misused, cause unintentional harm, or operate in ways opaque to users and regulators.    The EU AI Act establishes a clear, risk-based framework to protect individuals, businesses, and society from threats such as bias, misinformation, and privacy breaches. It also builds trust and accountability, ensuring AI developers and deployers follow ethical and legal standards.  Who Is Affected by the EU AI Act? The EU AI Act applies to all actors in the AI ecosystem: providers, deployers, importers, distributors, and product manufacturers.   In practice, anyone developing, using, importing, distributing, or manufacturing AI systems in the EU falls within its scope.  Importantly, the EU AI Regulations also have extraterritorial reach: providers and deployers located outside the EU must comply if their AI systems are intended for use within the EU.  The regulation defines “AI systems” broadly, covering machine learning, statistical approaches, and symbolic reasoning. This ensures that both advanced generative models and traditional rule-based AI are included.  Timeline for Implementation The EU AI Act entered into force on 1 August 2024 and becomes fully applicable on 2 August 2026. A phased rollout applies: Rule Date Prohibitions on certain AI practices, plus obligations related to AI literacy, come into force 2 Feb. 2025 Governance framework and obligations for general-purpose AI (GPAI) models apply. 2 Aug. 2025 Providers of high-risk AI systems embedded into regulated products have a longer transition period to comply. 2 Aug. 2027 Understanding the Risk-Based Framework The EU AI Act categorizes AI systems into four levels of risk:  Unacceptable risk: certain practices are strictly prohibited, such as manipulative or deceptive AI, social scoring, untargeted facial recognition scraping, or emotion recognition in workplaces and schools.    High risk: systems with serious implications for safety or fundamental rights, such as AI in medical devices, recruitment, education, law enforcement, border control, or judicial decision support. These are subject to the strictest obligations.    Limited risk: systems like chatbots or generative AI tools must meet transparency requirements, ensuring users know when they interact with AI.    Minimal or no risk: most everyday applications, like video games or spam filters, which are exempt from regulatory requirements.  Compliance Requirements for High-Risk AI Systems Providers of high-risk AI systems (HRAIS) must implement safeguards throughout the system’s lifecycle. These include:  Establishing a risk management system to identify and mitigate risks. Ensuring strong data governance and high-quality training datasets.    Preparing detailed documentation and logging mechanisms.  Providing transparency about the system’s capabilities and limitations.    Guaranteeing human oversight, so operators can supervise and intervene if needed.    Ensuring accuracy, robustness, and cybersecurity against errors and threats.    Setting up a quality management system for internal compliance.    Conducting post-market monitoring and reporting serious incidents within 15 days.  Before deployment, providers must complete a conformity assessment, affix CE marking, and register their system in the EU’s central database.  Deployers (users) also face obligations: in some cases, they must conduct a fundamental rights impact assessment (FRIA), follow the provider’s instructions, monitor operation, and keep system logs.  Bringing a High-Risk AI System to Market The compliance process follows four main steps:    Develop the system – design with risk and compliance in mind.    Conformity assessment – verify compliance, sometimes with the involvement of a notified body.    Registration – record the system in the EU database.    Declaration and CE marking – sign a declaration of conformity before market launch.    Any substantial modification to the AI system requires reassessment.  General Purpose AI and Foundation Models General-purpose AI (GPAI) models like ChatGPT, Gemini, or DALL·E face obligations mainly around transparency: preparing technical documentation, ensuring compliance with copyright law, and providing summaries of training data.  The Act also introduces rules for foundation models trained on large datasets. Some of these are designated as systemic risk foundation models, given their potential impact across multiple sectors. They face enhanced obligations, including rigorous model testing (such as red-teaming), systemic risk assessments, detailed regulatory reporting, strong cybersecurity, and even monitoring of energy efficiency.  Penalties for Non-Compliance Non-compliance with the EU AI Act carries heavy sanctions: fines of up to €35 million or 7% of global annual turnover, depending on the type and severity of the violation. This makes compliance not just a legal necessity but a business-critical priority.  Beyond the AI Act: Interplay with Other EU Laws The EU AI Act does not exist in isolation. It interacts with other key frameworks, including the GDPR (data protection), the Cyber Resilience Act (security), and the Product Safety & Machinery Regulation (for AI embedded in physical goods).   You can read more about how to stay compliant with the GDPR here. A successful compliance strategy must therefore be holistic, covering all these areas.  The EU AI Act is a landmark regulation: the first of its kind to establish a risk-based, trust-driven approach to AI. It balances innovation with protection, ensuring that harmful practices are banned, high-risk applications are tightly regulated, and transparency is guaranteed for general-purpose AI.  For businesses, compliance is not optional. Those that act early will not only avoid penalties but also position themselves as trusted leaders in responsible AI. 

A Practical Guide to Audit Documentation for Companies in France

When your company grows, restructures, or raises capital, several strategic operations may require the involvement of a statutory auditor (commissaire aux comptes). In France, these procedures are not just administrative formalities. They are essential steps to ensure transparency, protect shareholders, and build investor confidence. Yet, each type of audit or legal operation comes with its own set of required documents — often involving inputs from lawyers, chartered accountants, and management teams. This guide outlines the key documents you may need to prepare for the main types of audit engagements: statutory audits, contribution audits, transformation audits, merger audits, and equity operations. Statutory & Contractual Audit The statutory audit aims to ensures the accuracy and reliability of the annual financial statements. A contractual audit, on the other hand, is a voluntary engagement designed to strengthen investor confidence or prepare for a strategic transaction. Appointment: Statutory audit: appointed at the general assembly for six financial years. Contractual audit: freely chosen by the management or general assembly. Documents to be prepared* Sources Annual financial statements and appendices Chartered accountant Balance sheets, ledgers, journals Chartered accountant Intermediate financial statements Chartered accountant Minutes of general and board meetings Lawyer / Client Updated articles of association and shareholders agreement Lawyer Significant contracts Client Bank statements and confirmations Client / Chartered accountant Fixed asset register Chartered accountant Inventory, stock, and depreciation tests Client / Chartered accountant Tax declarations (corporate tax, VAT, etc.) Chartered accountant HR: DSN filings, registers, employment contracts Client Capitalization table and Shareholders’ register Lawyer / Client Legal disputes and lawyers’ attestations Lawyer Management representation letter Client *Non exhaustive list Contribution Audit The contribution auditor verifies the value of assets contributed (real estate, securities, business assets). This process helps protect shareholders and provides assurance to third parties regarding the fairness and accuracy of the valuation. Appointment: By unanimous agreement of the partners/shareholders, or failing that, by court order from the president of the commercial court. Documents to be prepared* Sources Draft articles of association including contributions Lawyer Valuation note / internal report Client / Chartered accountant Expert reports or third-party valuations Lawyer / Client Property deeds, notarized acts, Kbis extract Lawyer Financial statements (N-2 to N) Chartered accountant Capitalization table / Shareholders’ register Lawyer / Client Related contracts (leases, commercial agreements, etc.) Client Statement of debts linked to the asset Lawyer / Client Tax history (capital gains, depreciation) Chartered accountant Preparatory minutes of shareholders meetings Lawyer *Non exhaustive list Transformation Audit When a company changes its legal form (for example, from an SARL to an SAS) and does not have a statutory auditor (CAC) in place, an auditor must certify that the company’s equity is greater than or equal to its share capital. Appointment: By unanimous decision of the partners/shareholders, or failing that, by court order from the president of the commercial court. Documents to be prepared* Sources Draft articles of association post-transformation Lawyer Current articles of association and Kbis extract Lawyer Financial statement (less than 3 months old) Chartered accountant Statement of shareholders’ equity Chartered accountant Capitalization table / Shareholders’ register Lawyer / Client Draft minutes of transformation meeting Lawyer Statement of off-balance sheet commitments Lawyer / Client *Non exhaustive list Merger Audit During a merger, the auditor reviews the fairness of the share exchange ratio and ensures the protection of minority shareholders. Appointment: By court order from the president of the commercial court, unless all partners/shareholders of the companies involved unanimously agree to waive the requirement. Documents to be prepared* Sources Draft merger agreement Lawyer Draft amended articles of association Lawyer Management reports Lawyer / Client Annual financial statements (N-2 to N) Chartered accountant Interim financial statements Chartered accountant Valuations / due diligence reports Lawyer / Chartered accountant Minutes of corporate bodies Lawyer Statement of debts and off-balance sheet commitments Client Employee representative body (CSE) information/consultation Client Intragroup agreements Lawyer *Non exhaustive list Equity Operations In operations involving capital increases, fundraising, or the issuance of securities (BSPCE, BSA, OC, AGA, SO), the auditor ensures: the fairness of the valuation, the removal of pre-emptive subscription rights (DPS), and the protection of minority shareholders. Appointment: In-kind contributions / special benefits: by unanimous decision of the partners/shareholders, or by court order from the president of the commercial court (PTC) if unanimity is not reached. Removal of DPS / issuance of reserved securities: auditor appointed by court order from the PTC if no statutory auditor (CAC) is in place. Documents to be prepared* Sources Management report justifying the operation Lawyer / Client Draft amended articles of association Lawyer Pre-/post capitalization table Chartered accountant / Client Business plan, financial forecasts Chartered accountant / Client Term sheet / Shareholders’ agreement Lawyer In-kind contribution file Lawyer / Client Draft general assembly resolution Lawyer Annual financial statements (N, N-1, N-2) Chartered accountant Tax notes (share premium, BSPCE, etc.) Chartered accountant / Lawyer Issuance contracts (OC, BSPCE, etc.) Lawyer *Non exhaustive list Preparing the right documentation is one of the most effective ways to ensure that your audit or legal operation runs smoothly. Each type of audit, whether statutory, contribution-based, or linked to equity transactions, serves a different purpose, but they all share a common goal: securing your company’s growth with transparency and accuracy. At Reawave, our mission is to simplify these processes for you. By coordinating with your legal, accounting, and management teams, we turn complex compliance requirements into efficient, value-adding steps that build trust and strengthen your company’s financial credibility. Book a meeting today to get a personalized checklist for your next audit.

Understanding the Labour Law in France: Essentials for International Businesses

The labour law in France is known for being very comprehensive. This guide will take you through all the essentials you should know as an international business in France.

Compliance with GDPR: A Complete Guide for International Companies

The General Data Protection Regulation (GDPR) is one of the most comprehensive privacy laws in the world, setting strict standards for how personal data is collected, stored, and processed. For international companies, understanding what GDPR stands for, its key requirements, and the consequences of non-compliance is essential. This guide explains the meaning of GDPR, its global application, and the practical steps businesses can take to maintain compliance with GDPR while protecting customer trust. What is GDPR? (GDPR Meaning) The GDPR is a comprehensive EU data protection law that sets strict guidelines on how organizations collect, process, store, and share personal data. GDPR intends to give individuals greater control over their personal information while ensuring that businesses are transparent and accountable in their data practices. What does GDPR stand for? The full form of GDPR is General Data Protection Regulation. Does GDPR apply worldwide? Although it is an EU GDPR regulation, it applies to both EU-based companies and international companies outside the EU if they handle the personal data of EU residents. By setting clear rules, the regulation aims to strengthen GDPR data protection and safeguard privacy rights in today’s digital economy. What does it mean to be GDPR Compliant? Compliance with GDPR refers to an organization’s ability to meet all the requirements set out under the EU GDPR for collecting, storing, and processing personal data. Being GDPR compliant means ensuring transparency, security, and accountability in every stage of data handling. This includes obtaining valid user consent where necessary, implementing strong security measures, and responding promptly to data subject requests. Achieving GDPR compliance is not a one-time task, it requires continuous legal, technical, and organizational efforts to maintain GDPR data protection standards and adapt to evolving privacy risks. Who Needs to Ensure Compliance with GDPR? The EU GDPR applies to any organization, regardless of location, that collects or processes the personal data of individuals in the European Union. Its extraterritorial scope means that even businesses outside the EU must follow GDPR compliance rules if they offer goods or services to EU residents or monitor their online activities. Under the regulation, there are three key roles: Data Controllers – Organizations or individuals who determine the purpose and method of processing personal data. They hold primary responsibility for ensuring full compliance with GDPR in all data-handling activities. Data Processors – Third parties that process personal data on behalf of a controller. They are also required to be GDPR compliant and must implement robust technical and organisational safeguards. Data Subjects – Individuals whose personal information is collected and processed. The GDPR is designed to protect their rights, including access, correction, deletion, and objection to data use. Importantly, GDPR compliance obligations apply regardless of company size. What matters is not where your business is based, but how you collect, store, and manage personal data. Key GDPR Compliance Requirements The EU GDPR sets strict rules to protect individual privacy and promote transparency in how personal data is handled. Failing to meet these GDPR compliance obligations can lead to substantial fines and serious reputational harm. Below are the core requirements businesses, both in and outside the EU, must follow to remain GDPR compliant. 7 Data Protection Principles The regulation is based on seven key principles that guide responsible data management: Lawfulness, fairness, and transparency – Personal data must be collected legally, and individuals must be informed about its use. Purpose limitation – Data can only be used for clearly defined, legitimate purposes. Data minimization – Only collect the data necessary to fulfil the stated purpose. Accuracy – Keep personal data up to date and correct inaccuracies promptly. Storage limitation – Retain data only for as long as needed. Integrity and confidentiality – Use strong security measures to prevent breaches or unauthorized access. Accountability – Be able to demonstrate compliance with GDPR at all times. Legal Bases for Processing Before processing personal data, businesses must establish a lawful basis, such as: Consent – Individuals clearly agree to the processing of their data. Contractual necessity – Data is required to fulfil a contract. Legal obligation – Compliance with laws such as tax or employment regulations. Vital interests – Protecting someone’s life in urgent situations. Public interest – Performing official or governmental tasks. Legitimate interests – Activities like fraud prevention or security, provided they don’t override individual rights. Data Subject Rights GDPR grants individuals significant control over their personal data, including the right to: Access their information Correct inaccuracies Request deletion (“right to be forgotten”) Restrict or object to processing Transfer data to another provider Organizations must have processes in place to respond promptly to these requests. Documentation and Accountability Businesses must maintain detailed records of: Data types processed Processing purposes Data storage locations Retention periods Security measures in place Clear documentation supports transparency and helps demonstrate GDPR compliance during audits or investigations. Data Protection Officer (DPO) Requirement Organizations that process large-scale or sensitive personal data may be required to appoint a Data Protection Officer. The DPO oversees compliance efforts, advises on policies, and serves as a contact point for both regulators and data subjects. Even when not mandatory, having a DPO can greatly improve data protection governance. How to Stay Compliant with GDPR Staying GDPR compliant requires more than a one-time checklist, it’s an ongoing process of monitoring, updating, and improving your data protection practices. Below are key steps to help organizations meet EU GDPR requirements and maintain strong GDPR data protection standards. Understand the GDPR Principles Familiarize yourself with the seven core principles of the General Data Protection Regulation, lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. Aligning business processes with these principles is the foundation of compliance with GDPR. Conduct a Data Audit Identify all personal data you collect, process, and store—whether it belongs to customers, employees, or third parties. Record where it is stored, how long it is retained, and who has access to it. This will help you manage risks and identify gaps in compliance. Document and Record All

EU Omnibus Explained: Delays, Threshold Changes, and What Comes Next

In this article, we break down the core elements of the CSRD Omnibus, including the new compliance timelines, updated reporting thresholds, and what these changes mean for companies navigating the EU’s evolving ESG reporting regime.

EU’s CS3D: Your Guide to the Corporate Sustainability Due Diligence Directive

Whether you’re asking, “What is CS3D?” or already mapping your supply chain for compliance, this guide will help you breaks down the CS3D directive.

The CSRD Explained: A Practical Guide for International Businesses in EU

The CSRD is reshaping the way businesses report on sustainability and ESG performance in Europe. For international companies operating within or doing significant business in the EU, understanding CSRD is critical. With mandatory disclosure requirements, greater transparency standards, and harmonized rules, the CSRD aims to create a level playing field and ensure that sustainability reporting holds the same weight as financial reporting. This guide breaks down what the EU’s guidelines on reporting climate related information (CSRD), who it affects, what needs to be reported, and when. We also cover key definitions and thresholds, so international businesses can stay ahead of compliance. What is CSRD? (CSRD Meaning) The Corporate Sustainability Reporting Directive is a European Union regulation that expands and replaces the Non-Financial Reporting Directive (NFRD). It mandates detailed sustainability reporting by companies operating in the EU, including some non-EU firms. It is essentially the European Climate Reporting Standard. The CSRD was adopted in December 2022 as part of the European Green Deal and the broader EU Sustainable Finance Agenda. Its main objective is to improve the quality, consistency, and comparability of sustainability reporting across companies and industries. This new framework requires companies to publish an annual CSRD report as part of their management report, following the European Sustainability Reporting Standards (ESRS) developed by EFRAG. Who Needs to Comply? (Reporting Threshold Pre Omnibus) As per the EU’s guidelines on reporting climate related information, the following companies need to publish sustainability reports under CSRD: Large EU companies meeting 2 of the 3 criteria below: Over 250 employees Net turnover of more than €50 million Total assets exceeding €25 million Listed SMEs, except micro-enterprises, with simplified standards and a transition period until 2028. Non-EU companies that: Have a net turnover of €150 million or more in the EU, And own at least one EU-based subsidiary or branch that meets CSRD thresholds. CSRD Timeline (Pre Omnibus) The CSRD timeline for publishing sustainability reports is as follows: Entity Type Reporting Begins Data Period Covered Large Companies under NFRD FY 2024 Reports due in 2025 Large EU Companies newly covered by CSRD FY 2025 Reports due in 2026 Listed SMEs FY 2026 Reports due in 2027 Non-EU Companies FY 2028 Reports due in 2029 Note: Voluntary adoption is encouraged before mandatory deadlines, especially to align with investor expectations and ESG-focused stakeholders. What Is CSRD Double Materiality Concept? Double materiality is a core concept in the CSRD Directive. It means that companies must assess and report on sustainability matters from two perspectives: Financial Materiality – How environmental, social, and governance (ESG) issues impact the company’s financial position and performance. Impact Materiality – How the company’s operations affect people and the environment.   Under CSRD, both angles must be evaluated to provide a full picture of sustainability performance. This goes beyond traditional financial reporting and helps stakeholders better understand a company’s risks and impacts. This requirement applies to all in-scope companies and is central to the ESRS standards. Does CSRD Require Scope 3 Emissions Reporting? The CSRD requires disclosure of Scope 1, 2, and 3 greenhouse gas (GHG) emissions under the European Sustainability Reporting Standards (ESRS E1). Scope 1: Direct emissions from owned or controlled sources (e.g., company vehicles). Scope 2: Indirect emissions from purchased electricity, heat, or steam. Scope 3: All other indirect emissions in the value chain (e.g., supplier emissions, employee commuting, product use).   For many companies, Scope 3 accounts for the largest share of total emissions, and the CSRD emphasizes transparency here. While data availability challenges are recognized, companies are expected to progressively improve their disclosures and estimation methods. What Are the ESRS (European Sustainability Reporting Standards)? To ensure consistency and clarity in sustainability reporting, companies must report in line with the European Sustainability Reporting Standards (ESRS). Developed by EFRAG (European Financial Reporting Advisory Group), these standards outline how and what companies must disclose regarding ESG (Environmental, Social, and Governance) issues. The ESRS are split into: 2 General Standards – providing foundational reporting principles and company-wide disclosures. 10 Topical Standards – grouped under Environment, Social, and Governance, focused on material risks, impacts, and opportunities. Companies are only required to report on data points that are material to them, based on their double materiality assessment. For example, a manufacturer may focus on ESRS E2 (Pollution), while a consumer-focused company may emphasize ESRS S4 (Consumers and End-Users). Note: Climate-related disclosures (ESRS E1) are presumed material by default. Companies must justify if deemed otherwise. ESRS 1: General Principles ESRS 2: General Disclosures Covers: Foundational sustainability principles and reporting concepts Covers: Governance, strategy, impacts, risks & opportunities, measurement, and objectives Environment Social Governance ESRS E1 – Climate Change ESRS S1 – Own Workforce ESRS G1 – Business Conduct ESRS E2 – Pollution ESRS S2 – Workers in the Value Chain ESRS E3 – Water and Marine Resources ESRS S3 – Affected Communities ESRS E4 – Biodiversity and Ecosystems ESRS S4 – Consumers and End-Users ESRS E5 – Resource Use and Circular Economy Reporting, Publication, and Assurance Format: Reports must be embedded in the annual management report and published in digital x HTML format on the company’s website, unifying financial and non-financial disclosures. Timeline: Annual publication, within 4 months of financial year-end. Audit: Reports must be audited by an independent party, starting with limited assurance and evolving to reasonable assurance by October 2028. SMEs: Simplified sector-specific standards are being developed for listed SMEs, with a two-year opt-out option.   These standards aim not only to increase transparency, but also to embed sustainability into the heart of corporate strategy. What is Gap Analysis? Following the identification of material issues for the company and their associated indicators, the next step is to outline the data collection process in preparation for audit phases. This includes describing the data to be gathered: the scope covered, calculation methodology, level of detail, validation methods, etc. This initial selection and description of data enable the execution of a “gap analysis,” which involves identifying the gap between the information currently available and the reporting requirements. The process