Law / regulation
EU, Global
GDPR
General Data Protection Regulation (Regulation (EU) 2016/679)
The GDPR is the EU's main data protection law. It applies to any organisation established in the EU that processes personal data, and to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour. It sets principles, lawful bases, individuals' rights, security and breach duties, rules for processors and international transfers, and fines of up to EUR 20 million or 4% of global annual turnover.
Mandatory: Mandatory law for organisations in scope, including many outside the EU
Quick facts
- What it covers
- Collection, use, storage, sharing, transfer and deletion of personal data about people in the EU, by controllers and processors.
- Who needs it
- Any business processing personal data of people in the EU
- Why it matters
- Any IT or SaaS company with EU users or EU business customers is likely in scope, and EU customers will not sign without a data processing agreement and evidence of compliance.
- Key requirements
- Follow the 7 principles in Article 5, including data minimisation and accountability
- Have a lawful basis for every processing purpose (Article 6)
- Give clear privacy information (Articles 13 and 14)
- Honour data subject rights, usually within one month
- Sign processor contracts that meet Article 28
- Keep records of processing activities (Article 30)
- Apply appropriate security (Article 32)
- Report qualifying breaches to the authority within 72 hours
- Carry out DPIAs for high-risk processing
- Use a valid mechanism for transfers outside the EEA
- Where it applies
- EU/EEA, plus non-EU organisations offering goods or services to, or monitoring, people in the EU
- Category
- Data Privacy & Protection