🇪🇺General Data Protection Regulation

← Back to laws in European Union

GDPR: the European Union's core data protection framework

The General Data Protection Regulation is the central data protection law of the European Union. It protects natural persons in relation to the processing of their personal data and also supports the free movement of personal data within the Union. The GDPR is built around a simple but demanding idea: organisations may use personal data only when they can justify the processing, explain it clearly, protect it properly and respect the rights of the individual.

The GDPR applies to controllers and processors established in the Union. It can also apply to organisations outside the Union where their processing is connected with offering goods or services to people in the Union, or monitoring their behaviour in the Union. This is why the GDPR is often relevant for global websites, SaaS platforms, mobile apps, marketplaces, analytics providers and businesses serving EU users from outside Europe.

Who the GDPR protects and what it covers

The GDPR protects natural persons, not companies as legal persons. It covers personal data relating to an identified or identifiable person. This can include obvious identifiers such as name, email address and identification numbers, but also online identifiers, location data, device identifiers and other information that can be linked to a person.

The law is technologically neutral. It applies to automated processing and to structured manual filing systems. It does not generally apply to purely personal or household activity, but organisations that provide the means for such processing may still have their own GDPR responsibilities.

The principles are the foundation of GDPR compliance

Article 5 is the best starting point for understanding the GDPR. Personal data must be processed lawfully, fairly and transparently. It must be collected for specified, explicit and legitimate purposes, kept adequate and limited to what is necessary, kept accurate, retained only for as long as necessary, and protected through appropriate security.

The accountability principle turns these duties into an evidence obligation. It is not enough to say that data is being handled responsibly. A controller should be able to demonstrate how its notices, records, contracts, security measures, retention schedules, consent logs, assessments and internal procedures support GDPR compliance.

Lawful bases and special category data

Every processing activity needs a lawful basis under Article 6. Consent is only one option. Many processing activities may instead depend on contract necessity, legal obligation, vital interests, public task or legitimate interests. The correct basis matters because it affects the notice, rights response, withdrawal options and internal documentation.

Special category data receives stricter protection. This includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data and data concerning sex life or sexual orientation. Processing such data generally needs both an Article 6 lawful basis and a separate Article 9 condition.

Transparency and data subject rights

The GDPR requires clear information to be given to individuals. Articles 13 and 14 deal with information that must be provided when personal data is collected directly from the person or obtained from another source. In practice, this means privacy notices must explain who the controller is, why data is processed, the lawful basis, retention periods or criteria, recipients, international transfers, rights, complaints and relevant automated decision-making information.

Individuals have a set of enforceable rights. They can ask for access to their personal data, correction of inaccurate data, erasure in appropriate cases, restriction of processing, portability where applicable and objection to certain processing. Direct marketing deserves special attention because the GDPR gives individuals a clear right to object to processing for direct marketing purposes.

Controllers, processors and contracts

The GDPR distinguishes between controllers and processors. A controller decides the purposes and means of processing. A processor processes personal data on behalf of a controller. This distinction is important because the controller carries primary responsibility for deciding why the data is used, while processors have direct GDPR duties as well as contractual obligations.

Where a processor is used, the processing should be governed by a contract or other binding legal act. That arrangement should set out the subject matter, duration, nature and purpose of processing, the types of personal data, categories of data subjects and the obligations of the processor. Vendor onboarding, SaaS procurement, cloud hosting, payroll, analytics and outsourced support should all be reviewed through this lens.

Breach notification and incident readiness

The GDPR treats breach response as a governance issue, not merely an IT issue. A personal data breach can involve accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Controllers must assess whether the breach creates risk for individuals and must notify the supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach unless the breach is unlikely to result in risk to rights and freedoms.

Where a breach is likely to result in high risk to individuals, affected data subjects may also need to be informed without undue delay. This makes preparation essential: incident classification, evidence preservation, processor escalation timelines, legal review, communication templates and decision logs should exist before a breach occurs.

International transfers

The GDPR permits transfers of personal data outside the European Economic Area only where the transfer mechanism satisfies the GDPR's transfer rules. Transfers may rely on an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a specific derogation where the GDPR allows it.

International transfer compliance should not be treated as a clause-copying exercise. Organisations should know what data is transferred, where it goes, who receives it, whether onward transfers occur, what safeguards apply and whether the receiving environment creates additional risks for individuals.

Enforcement and penalties

Supervisory authorities have investigative, corrective, authorisation and advisory powers. They may carry out audits, require information, order compliance, restrict processing, suspend data flows and impose administrative fines depending on the circumstances.

The GDPR's highest administrative fine tier can reach up to EUR 20 million or, for an undertaking, up to 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher. The law also recognises complaints, judicial remedies and compensation for damage caused by processing that infringes the Regulation.