GDPR
Also known as: General Data Protection Regulation
EU regulation on data protection and privacy applicable to processing of EU residents' personal data.
The General Data Protection Regulation is the European Union's comprehensive data protection law, applicable since May 2018, governing processing of personal data of EU residents. The regulation's substantial extraterritorial reach — applying to non-EU organizations that process EU residents' data — has made it a de facto global standard for many multinational organizations. GDPR is built around principles including lawfulness, purpose limitation, data minimization, and accountability, and grants data subjects rights including access, rectification, erasure, and portability. Enforcement is by national data protection authorities with fines up to 4% of global annual revenue, which has produced multi-hundred-million-euro penalties against major technology companies.
Core components
- Six lawful bases for processing
- Seven data protection principles
- Data subject rights (access, rectification, erasure, portability, objection, restriction, automated decision-making)
- Data Protection Impact Assessments
- Data Protection Officer requirement (in specified cases)
- Data breach notification (72-hour)
- Cross-border transfer mechanisms
Primary use case
Data protection compliance for organizations processing EU residents' personal data; foundation for many subsequent privacy regimes globally; basis for privacy-by-design and privacy engineering practices.
Common criticisms
- Compliance burden disproportionate for small organizations
- consent fatigue from cookie banners and notices
- conflict with other regulatory regimes (particularly US national security data access)
- enforcement uneven across member states
- tension with AI/ML training data requirements.
Lineage
- Child of
- FIPPs
- Siblings
- CCPA, HIPAA, Privacy by Design, FIPPs
- Derived from
- FIPPs