GDPR applies based on whose data you process, not where your company is based — if your product has users in the EU, or you're targeting EU customers, GDPR's rules on consent, data subject rights, and lawful processing apply to you regardless of being headquartered in Sydney or Melbourne.
This is separate from Australia's own Privacy Act — a product can need to satisfy both.
In practice: clear, opt-in consent before collecting personal data; a real way for users to access, correct, or delete their data; data processing agreements with every vendor that touches that data (hosting, analytics, email); and a plan for reporting a breach without delay once you know about it. None of this requires a specific tech stack — it requires these flows to actually exist and actually work.
Be skeptical of a vendor who says their software is "GDPR-compliant" as if that's a fixed, finished state — compliance depends on how a specific product handles specific data, not a label a vendor applies to itself. Ask instead: will you sign a DPA, how do you handle access control and encryption, and can you show the actual consent and deletion flows you'd build. We're direct about this ourselves — our own Trust & Security page (code5x.com/trust) states plainly where we don't hold a formal certification, rather than implying one.
