What is GDPR?

The General Data Protection Regulation (GDPR) is a European Union law that took effect on 25 May 2018. It governs how organizations must handle the personal data of individuals in the EU, the UK (which retained its own UK GDPR after Brexit), and the European Economic Area.

Core principles

GDPR requires organizations to process personal data:

• Lawfully, fairly, and transparently.
• For specified, explicit, and legitimate purposes — no repurposing without a lawful basis.
• Limited to what is necessary for those purposes (data minimization).
• Kept accurate and up to date.
• Retained only as long as necessary.
• Protected by appropriate technical and organizational security measures.

Data subject rights

Individuals whose personal data is processed have specific rights, including:

• The right to be informed about how their data is used.
• The right of access to their data.
• The right of rectification if their data is inaccurate.
• The right of erasure ("right to be forgotten") in certain circumstances.
• The right to restrict processing.
• The right to data portability.
• The right to object to processing.
• Rights regarding automated decision-making.

Enforcement

GDPR is enforced by national data-protection authorities across the EU. Non-compliance can carry fines of up to the greater of €20 million or 4% of worldwide annual turnover.

Related

• To Whom Does GDPR Apply?
• Controller vs. Processor