GDPR: General Data Protection Regulation (EU 2016/679)

The General Data Protection Regulation (GDPR) is the EU's data protection framework. It governs how organisations collect, process, store and share the personal data of individuals in the European Economic Area. Adopted in April 2016 and applicable since 25 May 2018, the GDPR replaced the 1995 Data Protection Directive and set a single data protection standard across all EU Member States. It applies to any organisation worldwide that processes the personal data of people in the EU, wherever the organisation is based. The GDPR introduced core principles such as data minimisation, purpose limitation, storage limitation and accountability, along with stronger individual rights such as the rights of access, rectification, erasure and data portability, and the right to object to automated decision-making.

1. Any organisation that processes the personal data of people in the EU/EEA, as a controller or a processor, wherever the organisation is located.
2. Companies offering goods or services to individuals in the EU, or monitoring the behaviour of individuals within the EU.
3. Public authorities and bodies that process personal data, with specific provisions for law enforcement and national security.
4. Organisations of all sizes, though those with fewer than 250 employees benefit from certain exemptions from record-keeping obligations.

1. 01

   Lawful basis for processing

   Organisations must identify and document a valid legal basis for each processing activity, such as consent, contractual necessity, legal obligation, vital interests, public interest or legitimate interests.

2. 02

   Data subject rights

   Organisations must enable rights including access, rectification, erasure (the right to be forgotten), restriction of processing, data portability and the right to object to processing.

3. 03

   Data protection impact assessments

   DPIAs are mandatory for processing likely to result in a high risk to individuals' rights, including systematic profiling, large-scale processing of special categories of data and large-scale monitoring of publicly accessible areas.

4. 04

   Data breach notification

   Personal data breaches must be reported to the supervisory authority within 72 hours of becoming aware of them. Affected individuals must also be told when the breach poses a high risk to their rights.

5. 05

   Data protection officer (DPO)

   A DPO must be appointed by public authorities, by organisations that carry out regular and systematic monitoring of individuals on a large scale, and by those that process special categories of data on a large scale.

6. 06

   International data transfers

   Transfers of personal data outside the EEA require an adequacy decision from the European Commission or appropriate safeguards such as standard contractual clauses (SCCs) or binding corporate rules (BCRs).

The most serious GDPR infringements can lead to administrative fines of up to 20 million euros or 4% of global annual turnover, whichever is higher. Other infringements can lead to fines of up to 10 million euros or 2% of global annual turnover. Supervisory authorities can also issue warnings and reprimands, order compliance, impose temporary or definitive bans on processing and order the erasure of data. Since enforcement began, data protection authorities across Europe have imposed billions of euros in fines, including major penalties on technology companies, financial institutions and telecommunications providers.

1. Apr 2016

   GDPR adopted by the European Parliament and the Council.

2. May 2018

   GDPR applies across all EU Member States.

3. Jul 2020

   The Schrems II ruling invalidates the EU-US Privacy Shield, affecting international data transfers.

4. Jun 2021

   European Commission adopts new standard contractual clauses (SCCs).

5. Jul 2023

   Adequacy decision for the EU-US Data Privacy Framework adopted.