The General Data Protection Regulation (GDPR) is the EU's comprehensive data protection law that sets strict requirements for how organizations collect, process, and protect personal data of EU residents. Non-compliance can result in fines up to 4% of global annual revenue.
What is GDPR?
GDPR applies to any organization that processes personal data of EU residents, regardless of where the organization is located. It establishes strict requirements for data protection and grants significant rights to individuals over their personal data.
Personal data includes any information relating to an identified or identifiable person—names, emails, IP addresses, cookie identifiers, location data, and more.
Key Principles
Lawfulness, Fairness, Transparency: Process data legally, fairly, and with clear communication to individuals
Purpose Limitation: Collect data for specified, explicit purposes only
Data Minimization: Collect only what's necessary for the stated purpose
Accuracy: Keep personal data accurate and up to date
Storage Limitation: Retain data only as long as necessary
Integrity and Confidentiality: Protect data with appropriate security measures
Data Subject Rights
Right to Access: Individuals can request copies of their personal data
Right to Rectification: Correct inaccurate personal data
Right to Erasure: "Right to be forgotten"—delete personal data upon request
Right to Portability: Receive data in a portable format for transfer to another service
Right to Object: Object to processing for marketing or certain other purposes
Response Time: Requests must be addressed within 30 days
Lawful Basis for Processing
You must have one of these legal bases to process personal data:
Consent: Individual has given clear consent (must be freely given, specific, informed)
Contract: Processing is necessary to perform a contract with the individual
Legal Obligation: Processing is required by law
Vital Interests: Processing is necessary to protect someone's life
Legitimate Interests: Processing is necessary for your legitimate interests (requires balancing test)
Breach Notification
72-Hour Rule: Notify supervisory authority within 72 hours of becoming aware of a personal data breach
Individual Notification: Notify affected individuals if breach is likely to result in high risk to their rights
Documentation: Maintain records of all breaches, including ones not reported
Cross-Border Transfers
Adequacy Decisions: Transfer freely to countries with adequate data protection (e.g., UK, Canada, Japan)
Standard Contractual Clauses (SCCs): EU-approved contract terms for transfers to non-adequate countries
Data Privacy Framework: US companies can self-certify for EU-US data transfers
Transfer Impact Assessments: May be required to assess risks of transfers to certain countries