GDPR vs PCI, how do the scopes overlap?

They overlap in 3 places and diverge in the rest:

Overlap (both frameworks require these):

• Encryption at rest: PCI mandates it for cardholder data; GDPR mandates it for any "special category" personal data, both effectively require database-at-rest encryption.
• Access logging: PCI requires admin-access logs for ~12 months; GDPR requires audit trails for processing of personal data. One SIEM serves both.
• Breach notification: PCI doesn’t mandate customer notification but card brands do (typically 30 days); GDPR mandates regulator notification within 72 hours of awareness.

PCI-only (not GDPR):

• Specific cryptography requirements (e.g. TLS 1.2+ mandate).
• Quarterly external vulnerability scans by an ASV.
• Annual penetration testing for SAQ A-EP and higher.
• Specific compensating controls + scoping rules.

GDPR-only (not PCI):

• Right to data export (subject access request, 30-day SLA).
• Right to be forgotten (data deletion, 30-day SLA).
• Lawful basis documentation for every processing activity.
• DPIA (Data Protection Impact Assessment) for high-risk processing.
• Privacy by design + by default.

The audit’s q14 specifically checks for the GDPR-only data-export endpoint, because PCI doesn’t cover that and stores often miss it. If you sell to EU/UK customers, GDPR applies regardless of where your servers live.