Loading...
General Data Protection Regulation (EU 2016/679)
The General Data Protection Regulation establishes comprehensive data protection rules for all organisations processing personal data of EU residents. With extraterritorial scope, it applies globally to any entity offering goods or services to EU residents or monitoring their behaviour. GDPR enforces data protection through a two-tier penalty structure reaching EUR 20 million or 4% of global turnover.
99
Articles
11
Chapters
€20M / 4%
Max Penalty
May 2018
Enforced Since
Seven principles: lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
Six lawful bases for processing (consent, contract, legal obligation, vital interests, public task, legitimate interests). Consent must be freely given, specific, informed, and unambiguous.
Rights to access, rectification, erasure (‘right to be forgotten’), restriction, data portability, objection, and protection against automated decision-making. Response within 1 month.
Notify supervisory authority within 72 hours of becoming aware of a breach. Notify data subjects without undue delay if breach is likely to result in high risk to their rights.
Required prior to processing that is likely to result in high risk: systematic profiling, large-scale special categories, or systematic monitoring of public areas.
Mandatory DPO for public authorities, organisations with large-scale monitoring, or large-scale processing of special categories. Reports directly to highest management.
Transfers to third countries require adequacy decisions, appropriate safeguards (SCCs, BCRs), or specific derogations. Ensures continued protection outside the EU.
Two tiers: up to EUR 10M or 2% turnover for procedural violations; up to EUR 20M or 4% turnover for violations of core principles, data subject rights, and transfer rules.
Identify all personal data flows, processing activities, and data stores across your organisation to establish a complete processing register (Art. 30).
Determine the appropriate lawful basis for each processing activity. Review consent mechanisms, contract necessity, and legitimate interest assessments.
Conduct DPIAs for high-risk processing activities. Assess necessity, proportionality, and implement measures to address identified risks.
Build processes to handle data subject requests within required timelines: access, rectification, erasure, portability, and objection requests.
Establish a 72-hour breach notification process, including detection, assessment, authority notification, and data subject communication procedures.
Implement continuous monitoring, regular audits, staff training, and policy reviews to maintain compliance and demonstrate accountability.