What is the GDPR?
The General Data Protection Regulation (GDPR) is the EU law, applying since 25 May 2018, that governs how organizations process the personal data of people in the EU. It requires a lawful basis, transparency and security, gives individuals rights such as access and erasure, and allows fines of up to €20 million or 4% of worldwide turnover.
TL;DR
- Applies worldwide to the personal data of people in the EU.
- Qualifying breaches go to the regulator within 72 hours where feasible.
- Individual requests get an answer within one month, extendable by two.
Reviewed by the ComplyEasyAI compliance teamLast reviewed
How does the GDPR work in practice?
The GDPR took effect in 2018 and applies to organizations that process the personal data of individuals in the EU, regardless of where the organization is based. It is built on principles including lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity, and accountability.
The regulation grants data subjects rights such as access, rectification, erasure, restriction, portability, and objection. Organizations must be able to respond to these requests within defined timeframes and to demonstrate compliance through documentation such as a Record of Processing Activities.
Key operational obligations include maintaining a lawful basis for processing, conducting a Data Protection Impact Assessment for high-risk activities, reporting qualifying personal-data breaches within 72 hours, and applying appropriate technical and organizational security measures.
What else do people ask about the GDPR?
Does the GDPR apply to US companies?
Yes, when they offer goods or services to people in the EU or monitor their behavior there, even without an EU establishment.
What are the six lawful bases for processing?
Consent, contract, legal obligation, vital interests, public task and legitimate interests (Article 6).
Go deeper: GDPR compliance guide
Which terms are related to the GDPR?
- DPIAA Data Protection Impact Assessment (DPIA) is a structured review, required by Article 35 of the GDPR, that an organization completes before starting processing likely to pose a high risk to people’s rights. It describes the processing, tests necessity and proportionality, identifies risks, and records the measures that reduce them.
- RoPAA Record of Processing Activities (RoPA) is the inventory of personal-data processing that Article 30 of the GDPR requires most organizations to keep. For each activity it records the purpose, categories of people and data, recipients, international transfers, retention periods and security measures, and it must be shown to regulators on request.
- Vendor Risk ManagementVendor risk management (VRM) is the process of identifying, assessing and monitoring the security, privacy and operational risks that suppliers and service providers bring. A typical program inventories vendors, tiers them by criticality and data access, reviews questionnaires and attestations such as SOC 2 reports, and tracks remediation and contract terms over time.
- Continuous ComplianceContinuous compliance is the practice of monitoring controls and collecting evidence all the time, not just before an audit, so an organization knows its compliance posture on any given day. Integrations watch source systems, alerts fire when a control drifts, and issues are fixed close to when they occur, which matters most for SOC 2 Type II.