GDPR

Definition

The General Data Protection Regulation (GDPR) is the European Union’s data privacy law, setting rules for how organisations collect, process, and store personal data. It applies to any company dealing with data from EU citizens, regardless of location. GDPR aims to protect individuals’ privacy and grant them more control over their personal information in a digital world.

Why Use

• Builds trust by demonstrating respect for individual privacy
• Avoids heavy fines and legal actions for non-compliance
• Enables smoother business with EU-based customers
• Improves internal data handling and security standards

Core Concepts

• Lawful basis for collecting personal data
• Clear and specific user consent requirements
• Rights to access, rectify, and delete data
• Breach notification obligations
• Data Protection Officer (DPO) responsibility

Examples

Scenario 1: An e-commerce retailer asks for explicit consent before collecting email addresses for marketing.

Scenario 2: A software provider promptly notifies customers after discovering a data breach affecting their accounts.

Common Pitfalls

• Assuming GDPR only affects EU companies
• Neglecting to document data processes and decisions
• Failing to obtain clear user consent for communications

See Also

Related terms: Data Protection, Consent, Data Breach, and ePrivacy.