What is GDPR and what does it regulate?

GDPR is the EU's General Data Protection Regulation that governs how personal data must be collected, processed, stored, and protected by organizations.

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018, across the European Union. It replaces the Data Protection Directive 95/46/EC and significantly strengthens data protection rights for EU residents.

GDPR regulates how organizations collect, process, store, and transfer personal data of EU citizens. Personal data includes any information that can identify an individual, such as names, email addresses, IP addresses, and even cookies. The regulation applies to all companies processing EU residents' data, regardless of where the company is located.

Key principles include lawfulness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. Organizations must obtain explicit consent for data processing, implement privacy by design, conduct data protection impact assessments for high-risk processing, and report data breaches within 72 hours.

GDPR grants individuals enhanced rights including access to their data, rectification, erasure ("right to be forgotten"), data portability, and the right to object to processing. Non-compliance can result in fines up to €20 million or 4% of annual global turnover, whichever is higher.

As Eveline Van den Abeele from Rechtaan notes, understanding these fundamentals is crucial for any organization handling personal data in today's digital landscape.

For personalized guidance, consult a GDPR Compliance specialist on TinRate.