The General Data Protection Regulation (GDPR) is a comprehensive data protection law enacted by the European Union (EU) in May 2018. It aims to enhance the protection of personal data for all individuals within the EU and the European Economic Area (EEA) and addresses the export of personal data outside these regions.
Key Provisions of GDPR:
- Personal Data Protection: GDPR establishes strict rules on how businesses collect, store, and process personal data. Personal data refers to any information that can be used to identify an individual, such as names, emails, phone numbers, and IP addresses.
- Consent: Organizations must obtain explicit consent from individuals to process their personal data. Consent must be informed, unambiguous, and given through a clear affirmative action.
- Data Subject Rights: GDPR grants individuals several rights regarding their personal data:
- Right to Access: Individuals can request access to their personal data.
- Right to Rectification: They can correct inaccurate or incomplete data.
- Right to Erasure (Right to be Forgotten): They can request the deletion of their data under certain conditions.
- Right to Restrict Processing: They can limit how their data is used.
- Right to Data Portability: Individuals can obtain their data in a format that is easily transferable to another service provider.
- Data Breach Notification: Organizations must report data breaches within 72 hours of discovery, particularly if the breach risks the rights and freedoms of individuals.
- Fines and Penalties: Failure to comply with GDPR can result in significant fines—up to 4% of annual global revenue or €20 million (whichever is higher).
Global Impact:
While GDPR applies to companies operating in the EU, it has global implications, as it applies to any organization processing the personal data of EU citizens, regardless of location.
Example:
A U.S.-based company that processes data of EU residents would need to comply with GDPR. For example, if a customer from Germany provides their email address to a U.S. company, the company must ensure that their personal data is protected in line with GDPR regulations.
