GDPR

The GDPR is the European Union’s data protection regulation, in force since 2018. It applies to organisations that process the personal data of people in the EU and the EEA, whether or not the organisation is based there. Enforcement sits with the supervisory authority in each member state, and fines can reach four percent of worldwide annual turnover for the most serious infringements.

Most of the recurring work sits in a handful of articles. Article 30 requires a current record of processing activities. Article 5 sets the principles each processing purpose must satisfy, including a lawful basis recorded before processing starts. Articles 32 to 35 cover security of processing, notification of a personal data breach to the authority within 72 hours, and impact assessments for processing that is likely to be high risk.

People hold rights under the regulation — access, rectification, erasure, portability, and objection among them — and a request normally has to be answered within one month. Personal data may move outside the EEA only under an adequacy decision or a safeguard such as standard contractual clauses. The evidence is mostly dated records: the processing register, the request log, and signed processor terms.