What is GDPR?
The General Data Protection Regulation is a comprehensive data protection law in the European Union that gives individuals control over their personal data. It establishes strict requirements for how organizations collect, process, store, and transfer personal information.
Also known as: General Data Protection Regulation
GDPR is the world's strongest privacy law. Enacted in 2018, it fundamentally changed how organizations handle personal data and gave individuals unprecedented control over their information.
Key Rights for Individuals
Right to Access
- Request a copy of all data a company holds about you
- Free of charge, within 30 days
- Must be in accessible format
Right to Rectification
- Correct inaccurate personal data
- Complete incomplete data
Right to Erasure ("Right to be Forgotten")
- Request deletion of your data
- Some exceptions (legal requirements, public interest)
Right to Data Portability
- Get your data in machine-readable format
- Transfer to another service
Right to Object
- Opt out of direct marketing
- Object to automated decision-making
Requirements for Organizations
Consent
- Must be freely given, specific, informed
- Can't be buried in terms of service
- Easy to withdraw as it is to give
Data Minimization
- Collect only what's necessary
- Don't keep data longer than needed
Security
- Appropriate technical measures
- Breach notification within 72 hours
Accountability
- Document compliance
- Appoint Data Protection Officer (if required)
- Conduct impact assessments
Global Impact
GDPR applies to:
- Any organization offering goods/services to EU residents
- Any organization monitoring EU residents' behavior
- Not just EU companies—global reach
Enforcement
Penalties can reach:
- €20 million, or
- 4% of global annual turnover
- Whichever is higher
Major fines have been issued to Amazon (€746M), WhatsApp (€225M), Google (€90M), and many others.
Related Terms
Data Minimization
A privacy principle that organizations should collect only the minimum amount of personal data necessary for a specific purpose, and retain it only as long as needed. This reduces privacy risks by limiting exposure in case of breaches or misuse.
Privacy by Design
An approach to systems engineering that takes privacy into account throughout the entire engineering process. Rather than bolting privacy protections onto existing systems, Privacy by Design builds privacy into the architecture from the ground up.
Right to Be Forgotten
A legal right, primarily under GDPR Article 17, that allows individuals to request the deletion of their personal data from organizations and search engine results when it's no longer necessary or was processed without proper consent.
Have more questions?
Use our guided flow to get the right next privacy step for GDPR.
Open Guided Flow