General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) is the cornerstone of European data protection law, applicable since 25 May 2018. It replaced the 1995 Data Protection Directive and established a unified framework for data protection across all EU and EEA member states.

GDPR applies to any organisation — regardless of location — that processes personal data of individuals in the EU, provided it offers goods or services to EU residents or monitors their behaviour. This extraterritorial scope means companies worldwide must comply if they handle EU personal data.

The regulation is built on seven core principles: lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Organisations must demonstrate compliance with all seven principles, not merely assert it.

Key rights granted to individuals include the right of access, right to rectification, right to erasure ("right to be forgotten"), right to restrict processing, right to data portability, and the right to object. Data subjects must be informed about processing in clear, plain language.

Organisations processing personal data at scale or handling special categories of data (health, biometric, genetic, political opinions, religious beliefs, trade union membership, sexual orientation) must appoint a Data Protection Officer (DPO). All organisations must maintain records of processing activities and conduct Data Protection Impact Assessments (DPIAs) for high-risk processing.

Data breaches must be reported to the supervisory authority within 72 hours where feasible, and affected individuals must be notified without undue delay when the breach poses a high risk to their rights and freedoms. Cross-border data transfers outside the EEA require appropriate safeguards such as Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or an adequacy decision from the European Commission.