What is the GDPR?
The General Data Protection Regulation (Regulation (EU) 2016/679) is the European Union’s core data protection law. It has applied since 25 May 2018 and also covers the wider European Economic Area. It protects people’s fundamental right to the protection of their personal data and sets rules for how organisations may process that data.
Purpose and objectives
GDPR seeks to:
- give individuals transparency and control over their personal data;
- make organisations accountable for showing, not just claiming, compliance;
- harmonise data protection rules across the EU single market;
- protect personal data when it is transferred outside the EEA.
Who does it apply to?
Material scope. GDPR applies to processing personal data wholly or partly by automated means, and to manual processing within filing systems. It excludes purely personal or household activity, and some areas such as law enforcement processing, which is covered by a separate directive.
Territorial scope (Article 3).
- Organisations established in the EU processing personal data in the context of that establishment, wherever the processing happens.
- Organisations outside the EU that offer goods or services to people in the EU, or monitor their behaviour there.
Roles. A controller determines the purposes and means of processing. A processor processes on the controller’s behalf. Both have obligations, and processors must work under a contract that meets Article 28.
The principles (Article 5)
| Principle | In practice |
|---|---|
| Lawfulness, fairness and transparency | Have a lawful basis, and tell people clearly what you do |
| Purpose limitation | Collect for specified purposes and don’t reuse incompatibly |
| Data minimisation | Only what is adequate, relevant and necessary |
| Accuracy | Keep data accurate and up to date |
| Storage limitation | Keep identifiable data no longer than necessary |
| Integrity and confidentiality | Appropriate security |
| Accountability | Be able to demonstrate compliance |
Lawful bases
Article 6 lists six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Processing special categories of data, such as health, biometric data used for identification, racial or ethnic origin, religious beliefs and sexual orientation, also needs an Article 9 condition. Criminal offence data is restricted under Article 10.
Rights of individuals
People have rights to be informed (Articles 13–14), of access, rectification and erasure, to restrict processing, to data portability, to object, and rights related to solely automated decisions with legal or similarly significant effects (Article 22). Controllers must normally respond within one month, which can be extended by two further months for complex or numerous requests.
Core accountability obligations
- Data protection by design and by default (Article 25).
- Records of processing activities (Article 30), with limited exemptions for small organisations.
- Security of processing appropriate to the risk (Article 32), such as pseudonymisation and encryption where appropriate, resilience, the ability to restore availability, and regular testing.
- Breach notification to the supervisory authority without undue delay and, where feasible, within 72 hours (Article 33). Affected people must be told when the risk is high (Article 34).
- Data protection impact assessments for likely high-risk processing (Article 35).
- Data protection officers where required, for example for public authorities or large-scale monitoring or special-category processing as a core activity (Articles 37–39).
International transfers
Personal data may leave the EEA only under Chapter V. The options include an adequacy decision (Article 45), such as the decision covering certified US organisations under the EU–US Data Privacy Framework; appropriate safeguards such as the Commission’s standard contractual clauses or binding corporate rules (Article 46); or narrow derogations (Article 49). Organisations using contractual safeguards are expected to assess the destination country’s laws and add supplementary measures where needed.
Enforcement
Each Member State has an independent supervisory authority. For cross-border processing, a lead supervisory authority generally coordinates under the one-stop-shop mechanism, with the EDPB issuing guidelines and resolving disputes. Administrative fines can reach €20 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements, and €10 million or 2% for others. Individuals can also seek compensation.
Implementation lifecycle
- Map data and processing. Build the record of processing activities.
- Assign lawful bases and check special-category conditions.
- Update transparency. Privacy notices, cookie and consent mechanisms.
- Rights handling. Intake, identity verification, response workflows and deadlines.
- Vendor management. Article 28 contracts, due diligence, transfer mechanisms.
- Security and breach readiness. Article 32 controls, and a breach assessment and notification playbook.
- DPIAs. Screening and assessment for new or changed high-risk processing.
- Governance. DPO or privacy lead, training, policies, audits and metrics.
Evidence and documentation
Supervisory authorities and auditors look for records of processing, lawful-basis assessments (including legitimate interests assessments), privacy notices, consent records, DPIAs, processor contracts, transfer impact assessments, the breach register and notifications, rights-request logs, training records and policies.
Common misconceptions and pitfalls
- “GDPR means we need consent for everything.” Over-relying on consent creates fragile processing that collapses when consent is withdrawn.
- “Encrypted data is outside GDPR.” Encrypted personal data is still personal data. Encryption reduces risk, for example in breach assessment.
- “72 hours to finish the investigation.” The deadline is for the initial notification. Information can be provided in phases.
- Copy-paste privacy notices that don’t describe what the organisation actually does.
Relationship with other frameworks
| Framework | Relationship |
|---|---|
| India’s DPDP Act | Comparable concepts, with different lawful grounds, rights mechanics and penalty model |
| ISO/IEC 27701 | A privacy information management system that can structure GDPR accountability. Certification is not proof of compliance |
| EU AI Act | Applies alongside GDPR where AI processes personal data |
| ISO/IEC 27001 | Supports Article 32 security and breach-response obligations |
| CCPA/CPRA | California’s consumer privacy regime, with a different structure (notice and opt-out centred) |
Open questions and items to watch
Points that were unsettled, contested or likely to change when this page was last reviewed. Check the official sources before relying on them.
- The Commission's November 2025 Digital Omnibus proposes changes to the GDPR, including how 'personal data' is defined relative to the holder of the data. The EDPB and EDPS objected to parts of it in Joint Opinion 2/2026. Track the legislative procedure before assuming any change applies.
- The EU–US Data Privacy Framework adequacy decision has been challenged before the EU courts. Organisations relying on it should keep a fallback transfer mechanism under review.
Frequently asked questions
Does GDPR apply to a company based outside the EU?
It can. Under Article 3, GDPR applies to controllers and processors outside the EU when they offer goods or services to people in the EU, or monitor their behaviour in the EU. Such organisations usually need to appoint a representative in the EU.
Do we always need consent?
No. Consent is one of six lawful bases in Article 6. The others are contract, legal obligation, vital interests, public task and legitimate interests. Choose the basis that genuinely fits each purpose before processing starts. Special category data also needs an Article 9 condition.
When must a breach be notified?
Controllers must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to individuals. If the breach is likely to result in a high risk, affected individuals must also be told without undue delay. All breaches must be documented internally.
When is a DPIA required?
A data protection impact assessment is required where processing is likely to result in a high risk to individuals' rights and freedoms. Examples include large-scale processing of special category data, systematic monitoring of publicly accessible areas, and certain profiling with significant effects. Supervisory authorities publish lists of processing that requires a DPIA.
Is UK GDPR the same as EU GDPR?
They share origins but are separate laws. After Brexit, the UK kept a domestic version, the UK GDPR, alongside the Data Protection Act 2018, and has since amended its regime. Check UK-specific guidance from the Information Commissioner's Office for UK processing.
Sources and official references
- Regulation (EU) 2016/679 (General Data Protection Regulation) — Official Journal text — EUR-Lex (Publications Office of the European Union) (official source)
- European Data Protection Board — guidelines, recommendations and best practices — European Data Protection Board (EDPB) (official source)
- Data protection in the EU — European Commission (official source)
- Adequacy decisions — European Commission (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with European Union; enforced by national supervisory authorities, coordinated through the European Data Protection Board (EDPB).
