What is the GDPR?
The General Data Protection Regulation (GDPR) is a set of rules that govern personal data collection and processing in the European Union (EU) and the European Economic Area (EEA). These rules were created to protect data privacy by ensuring personal data is collected and processed responsibly and transparently.
The GDPR was introduced in 2018 and replaced the Data Protection Directive (95/46/EC), which had been the main data protection policy since 1995.
Who does the GDPR apply to?
The GDPR applies to any organization that processes data of EU residents. It covers all data that can uniquely identify a person, including:
Basic identity information (name, address, ID/passport number).
Web data (IP addresses, location, cookies).
Health, genetic, and biometric data.
Racial or ethnic origin.
Political opinions or religious beliefs.
Sexual orientation.
Any other information that identifies an individual.
The seven principles of the GDPR
The GDPR outlines seven principles for sensitive data protection, defining how data controllers should collect, use, and safeguard personal information.
- 1.
Lawfulness, fairness, and transparency. Organizations must ensure their data processing is legal, clear, and serves the consumer's interests.
- 2.
Purpose limitation. Organizations must define the purpose for collecting personal data and retain it only as long as necessary to fulfill that purpose.
- 3.
Data minimization. Companies should only collect relevant and adequate data for the intended purpose.
- 4.
Accuracy. Personal data must be accurate, and any incorrect or irrelevant data should be corrected or deleted.
- 5.
Storage limitation. Companies can only keep personal data for as long as needed to achieve the processing purpose.
- 6.
Integrity and confidentiality. Data controllers must ensure proper data security, while processors must protect personal data from unauthorized use or loss.
- 7.
Accountability. Data processors must demonstrate compliance with GDPR principles, and controllers must prove they process personal data legally.
These seven principles are key to handling personal data safely and responsibly. By following them, organizations can build trust, reduce risks, and protect people’s privacy. Following the GDPR helps prevent security problems and promotes transparency and accountability, leading to better data protection for everyone in the EU.
GDPR non-compliance fines
Organizations that don't comply with the GDPR may face fines and other penalties, depending on the severity of the violation and the organization's size and resources. The GDPR defines two levels of fines for non-compliance:
Minor violations. These include issues like failing to keep records of processing activities or not appointing a data protection officer. Fines can be up to €10 million or 2% of the organization's global annual revenue, whichever is higher.
Severe violations. These involve more serious breaches, like processing personal data without legal grounds or not reporting a data breach. Fines can be up to €20 million or 4% of global annual revenue, whichever is higher.
Companies may also face other penalties, such as having their data processing operations suspended or being permanently banned from processing personal data.
Protect yourself online
Secure your traffic, boost your privacy, and block cyberthreats.
Know your GDPR rights
The GDPR empowers you to take control of your personal data and protect your privacy. It’s important to understand your digital rights and know that you can access the data companies hold about you — or even request its removal.
The right to be informed
The GDPR gives you the right to be informed about how companies collect and use your personal data, including how long they’ll keep your data and who can access it.
The right of access
Under the GDPR’s right of access, you can view the personal data an organization holds about you, including its purpose and how it is stored and processed.
The right to rectification
The GDPR gives you the right to rectification, meaning you can ask an organization to correct any inaccurate or incomplete personal data about you.
The right to erasure
Thanks to the GDPR’s right to erasure, you can ask an organization to delete your personal data, unless it’s needed for legal purposes.
The right to restrict processing
Under the GDPR’s right to restrict processing, you can request that an organization limit how your data is used or processed in specific circumstances.
The right to data portability
The GDPR’s right to data portability enables you to transfer your personal data to another organization in a format that’s easy to use and machine-readable.
The right to object
You can exercise the GDPR’s right to object, meaning you have the ability to refuse how your data is used, particularly for direct marketing or research purposes.
The right not to be subject to automated decision-making
The GDPR also gives you the right to ask that decisions about you be made by a human rather than automated systems.
GDPR usage examples
Privacy policy
Websites must clearly explain how they process user data in their privacy policies, ensuring compliance with the GDPR and protecting the user’s rights (including the right to be informed about data collection).
Cookie policy
Under the GDPR, websites must inform users about the cookies they use and allow them to choose which ones they want to accept. This respects the right to be informed and gives users more control over their data.
Third-party sites
Websites outside the EU must either comply with the GDPR provisions or block traffic from EU visitors to avoid violating the data subject's rights.
Pseudonymization
Organizations may use pseudonymization to replace personal data with identifiers, reducing privacy risks while still allowing data analysis. This technique also helps with data breach prevention by lowering the chances of exposing sensitive information.
Data security measures
Organizations are required to implement appropriate security measures to protect personal data from unauthorized access, ensure compliance with the GDPR, and safeguard users' rights.
User consent
Before handling sensitive data, organizations must get clear permission from users, making sure they follow GDPR rules and respect the right to object to processing.
Third-party sharing
When sharing data with third-party services, companies must ensure that those services comply with GDPR regulations, especially when sensitive information is involved.
Frequently asked questions
Online security starts with a click.
Stay safe with the world’s leading VPN
