General Data Protection Regulation (GDPR)

What Is GDPR?

The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection and processing of personal data of individualswithin the European Union (EU) and the European Economic Area (EEA). Enforced on 25May2018, it replaces the 1995 Data Protection Directive and aims to give citizens greater control over their personal information while simplifying the regulatory environment for businesses operating across Europe.

Key Definitions

• Personal data: Any information relating to an identified or identifiable natural person, such as name, email, IP address, biometric data, or location.
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, alteration, or erasure.
• Data subject: The individual whose personal data is being processed.
• Controller: The entity that determines the purposes and means of processing personal data.
• Processor: The entity that processes personal data on behalf of the controller.
• Consent: A freely given, specific, informed, and unambiguous indication of the data subjects wishes.

Core Principles

GDPR rests on six fundamental principles that all datahandling activities must respect:

1. Lawfulness, fairness and transparency Processing must have a legal basis, be fair to data subjects, and be communicated openly.
2. Purpose limitation Data may be collected only for specified, explicit, and legitimate purposes.
3. Data minimisation Only the minimum amount of data necessary for the purpose should be processed.
4. Accuracy Personal data must be kept accurate and uptodate; errors must be corrected without delay.
5. Storage limitation Retain data only as long as necessary for the intended purpose.
6. Integrity and confidentiality Ensure appropriate security, protecting data against unauthorised or unlawful processing, loss, or damage.

Legal Bases for Processing

GDPR recognises nine lawful grounds for processing personal data. At least one must apply before any processing begins:

• Consent of the data subject
• Performance of a contract
• Legal obligation
• Vital interests of the data subject or another natural person
• Public task carried out in the public interest or official authority
• Legitimate interests pursued by the controller or a third party, provided the interests of the data subject do not override them
• Special categories of data (e.g., health, biometric) must meet additional conditions
• Processing of personal data relating to criminal convictions and offences requires specific safeguards
• Childrens data consent must be obtained from a parent or guardian where required.

Rights of Data Subjects

GDPR empowers individuals with eight specific rights, enabling them to control how their data is used:

1. Right to be informed Clear communication about how personal data is processed.
2. Right of access Request a copy of all personal data a controller holds.
3. Right to rectification Correct inaccurate or incomplete data.
4. Right to erasure (right to be forgotten) Request deletion of data under certain circumstances.
5. Right to restriction of processing Limit how data is used.
6. Right to data portability Receive personal data in a structured, commonly used format and transmit it to another controller.
7. Right to object Object to processing based on legitimate interests or direct marketing.
8. Rights related to automated decisionmaking and profiling Request human intervention and contest decisions.

Controllers must respond to these requests without undue delay and, in most cases, within one month.

Obligations for Controllers and Processors

Both controllers and processors have specific duties under GDPR:

• Data Protection Impact Assessment (DPIA) Required for highrisk processing, such as largescale monitoring of public spaces.
• Recordkeeping Maintain detailed documentation of processing activities.
• Data breach notification Report serious breaches to the supervisory authority within 72hours and, when high risk, to affected individuals.
• Appoint a Data Protection Officer (DPO) Mandatory for public authorities, largescale processing of special categories, or systematic monitoring.
• Privacy by design and by default Embed data protection into systems and business processes from the start.
• International transfers Use mechanisms such as Standard Contractual Clauses, Binding Corporate Rules, or adequacy decisions for data leaving the EEA.

Enforcement and Penalties

Supervisory authorities in each EU Member State enforce GDPR. Noncompliance can lead to substantial fines:

• Up to 10million or 2% of worldwide annual turnover (whichever is higher) for violations of datasubject rights, consent, or breach notification.
• Up to 20million or 4% of worldwide annual turnover (whichever is higher) for infringements of core principles, data protection impact assessments, or international transfer rules.

Fines are proportionate, taking into account the nature, gravity, and duration of the breach, as well as any mitigation efforts.

Impact on Businesses Outside the EU

GDPR applies to any organisation, regardless of location, that offers goods or services to, or monitors the behaviour of, individuals within the EU. Consequently, companies worldwide often adopt GDPRaligned policies to maintain market access and avoid crossborder enforcement.

Practical Steps to Achieve Compliance

1. Map your data Identify what personal data you hold, where it comes from, and who you share it with.
2. Establish a lawful basis Document the justification for each processing activity.
3. Update privacy notices Ensure they are concise, clear, and cover all required information.
4. Implement security controls Encrypt data at rest and in transit, use strong access controls, and perform regular vulnerability testing.
5. Train staff Raise awareness of GDPR obligations and datahandling best practices.
6. Set up a breach response plan Define roles, communication channels, and timelines for reporting incidents.
7. Review contracts Include GDPRcompliant clauses with processors and thirdparty vendors.
8. Schedule periodic audits Monitor compliance, update DPIAs, and adjust processes as needed.

Resources

For more detailed guidance, consult the following official and reputable sources:

• Full text of the GDPR (Official Journal of the EU)
• European Commission Data Protection
• European Data Protection Board (EDPB) Guidelines
• UK Information Commissioners Office GDPR Guide
• IAPP Practical Guide

Conclusion

The GDPR represents a landmark shift toward stronger privacy protection and greater accountability for organisations handling personal data. While compliance can be challenging, adopting a transparent, securityfocused approach not only reduces legal risk but also builds trust with customers and partners. By understanding the core principles, respecting datasubject rights, and implementing robust governance, businesses can turn GDPR from a regulatory hurdle into a competitive advantage.