🛡️GDPR

NEW

Also known as: General Data Protection Regulation

EU regulation establishing rules for personal data protection and privacy across Member States.

DESCRIPTION

The General Data Protection Regulation (GDPR) standardizes data protection laws across the EU and strengthens individuals’ rights. It governs lawful bases for processing, transparency, consent, data subject rights, and international transfers. Organizations must implement privacy by design, perform DPIAs for high-risk processing, and report breaches. Non-compliance can lead to significant fines. GDPR influences global privacy practices and vendor contracts.

ALTERNATIVE DEFINITIONS

European Commission

The General Data Protection Regulation (GDPR) sets rules for the protection of personal data and applies to all companies processing data of people residing in the EU.

Notes scope across companies processing EU residents’ data.

Source

Information Commissioner’s Office (ICO)

The UK GDPR sits alongside the Data Protection Act 2018. It sets out key principles, rights and obligations for processing personal data.

Highlights principles, rights, and obligations under GDPR context.

Source

GDPR.eu

The GDPR is a comprehensive data protection law that requires businesses to protect the personal data and privacy of EU citizens for transactions that occur within EU member states.

Stresses comprehensive scope and business obligations.

Source

RELATED TERMS

Data Privacy Personal Data Consent Management Data Protection Impact Assessment Data Subject Rights Data Protection Officer AI Act Data Processing Agreement Records of Processing Activities

COMPETING TERMS

CCPA

KNOWLEDGE AREAS

Data Privacy & Compliance Data Governance AI Governance

TARGET AUDIENCE

Data Governance Manager Chief Data Officer Chief Information Officer Data Steward Data Management Consultant Digital Transformation Manager

EXTERNAL SOURCES

• Wikipedia - General Data Protection Regulation
• EUR-Lex - Official GDPR legal text
• European Data Protection Board - Guidelines and best practices
• ICO - Regulatory guidance on GDPR

TOP QUESTIONS

What is GDPR and who does it apply to?

GDPR is the EU’s data protection regulation. It applies to organizations processing personal data of individuals in the EU, regardless of the company’s location.

Category: Overview

What are the lawful bases for processing under GDPR?

Consent, contract, legal obligation, vital interests, public task, and legitimate interests are the lawful bases.

Category: Requirements

What rights do data subjects have under GDPR?

Access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making.

Category: Overview

What is privacy by design under GDPR?

It mandates embedding privacy in systems and processes, minimizing data and enabling controls by default.

Category: Best practices

What are common mistakes with GDPR compliance?

Insufficient records of processing, unclear consent, weak DPIAs, and inadequate vendor contracts are typical issues.

Category: Mistakes

What is the risk of non-compliance with GDPR?

Fines up to 4% of annual global turnover, reputational damage, and remediation costs.

Category: Risk

How does GDPR affect international data transfers?

Transfers require adequate safeguards like SCCs, adequacy decisions, or binding corporate rules.

Category: Requirements

Is GDPR relevant to AI systems?

Yes. It impacts lawful bases, transparency, profiling, data minimization, and data subject rights in automated decisions.

Category: Relevancy

When did GDPR take effect?

GDPR has applied since 25 May 2018, replacing the Data Protection Directive 95/46/EC.

Category: Origin