GDPR: Overview

Regulation: EU 2016/679 Applicability: From 25 May 2018 (Article 99) Scope: Personal data protection

GDPR (General Data Protection Regulation) is the EU regulation on the protection of natural persons with regard to the processing of personal data. Territorial scope follows Article 3: processing in the context of an EU establishment, and specified offers of goods/services to or monitoring of people in the EU by non-EU actors. Citizenship or residence alone does not define the scope.

Material scope and exclusions follow Art. 2: automated processing and non-automated processing in a filing system or intended for one; exceptions include purely personal/household activity and specified processing governed by other regimes. Art. 3(3) also covers processing by a controller outside the EU where Member State law applies by public international law.

Key Terms

Term	Definition
Personal data	Information relating to an identified or identifiable natural person (Article 4(1))
Data subject	Natural person whose data you process
Controller	Determines the purposes and means of processing
Processor	Processes data on behalf of the controller
DPO	Data Protection Officer
DSAR	Data Subject Access Request
DPIA	Data Protection Impact Assessment

Legal Bases for Processing

#	Legal Basis	Description	Examples
1	CONSENT	Freely given, specific, informed and unambiguous; withdrawable at any time. Explicit consent is required in particular cases.	Voluntary sign-up where consent is an appropriate basis; electronic marketing and cookies also have separate rules
2	CONTRACT (Contract)	Necessary for performance of a contract with the person or steps at their request before entering into one	Product/service delivery
3	LEGAL OBLIGATION (Legal obligation)	Law requires processing	Tax, accounting, regulatory reports
4	LEGITIMATE INTEREST (Legitimate interest)	Necessary for a legitimate interest of the controller or a third party, unless overridden by the person’s interests or fundamental rights and freedoms; document the assessment	Potential uses: fraud prevention or direct marketing; assess necessity, balancing and any separate marketing/cookie rules
5	VITAL INTEREST (Vital interest)	Necessary to protect the vital interests of the person or another natural person	Medical emergency
6	PUBLIC INTEREST (Public task)	Necessary for a task in the public interest or exercise of official authority vested in the controller; based on EU or Member State law	Government

Public authorities cannot use Article 6(1)(f) for processing in the performance of their tasks. The examples above do not automatically establish a lawful basis.

Data Subject Rights

Right	Article	Main scope
Access	Art. 15	Confirmation, access to the personal data and required information, and a copy of personal data undergoing processing; protect others’ rights and freedoms
Rectification	Art. 16	Correct inaccurate data and complete incomplete data, taking account of the purposes
Erasure	Art. 17	Erase where a statutory ground applies, subject to the exceptions in Art. 17(3)
Restriction	Art. 18	Restrict processing on the specified grounds; storage and uses permitted by Art. 18(2) remain possible
Portability	Art. 20	Receive data the person provided in a structured, commonly used, machine-readable format where processing is automated and based on consent or contract; direct transmission where technically feasible; protect others’ rights
Objection	Art. 21	For Art. 6(1)(e)/(f), an objection based on the person’s particular situation; direct marketing must cease on objection. Research/statistics have the Art. 21(6) rule
Automated decision-making	Art. 22	Right not to be subject to a solely automated decision with legal or similarly significant effects; statutory exceptions and safeguards apply

Article 12(3): provide information on action taken without undue delay and within one calendar month of receipt. A necessary extension of up to two further months is possible for complexity/number of requests; notify the person with reasons within the first month. If no action is taken, explain the reasons and the right to complain to a supervisory authority and seek a judicial remedy without delay and within one month (Art. 12(4)). Assess each right’s conditions and exceptions; portability does not cover public-task/official-authority processing under Art. 20(3). For the contract/explicit-consent exceptions to Art. 22, safeguards include at least human intervention, expressing a point of view and contesting the decision; Art. 22(4) additionally restricts special-category data. A suggested internal acknowledgement target does not extend a legal deadline.

DSAR Workflow

Data Breach Notification

Duty	Trigger and time
Processor → controller	Notify a personal data breach without undue delay after becoming aware (Art. 33(2))
Controller → supervisory authority	Without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to people’s rights and freedoms (Art. 33(1)); explain delay and supplement information if necessary
Controller → affected people	Without undue delay where a high risk is likely, subject to Art. 34(3) exceptions; this is not a universal 72-hour deadline
Breach record	Document all personal data breaches, their effects and remedial action, including the reason for not notifying (Art. 33(5))

Encryption is relevant to risk, not an automatic exemption from authority notification: consider key compromise, integrity and availability as well as disclosure. Unencrypted or health data needs careful risk assessment; the data label alone does not replace the statutory test. Containment and assessment start immediately, without waiting for a 24-hour review milestone.

Penalties

Article 83 distinguishes specific infringements, not a generic “medium/severe” scale. Paragraph 4 sets a ceiling of EUR 10 million or 2% of worldwide annual turnover for the preceding financial year; paragraphs 5–6 set EUR 20 million or 4%, whichever is higher for an undertaking. The actual fine depends on the infringement and proportionality factors in Article 83(2). A statutory maximum is not an expected loss or a promised ROI from compliance work.

Next Steps

Resources

Content reviewed: 6 September 2026. Primary sources: GDPR — Arts. 3, 5, 6, 9, 12–22, 28–39, 83.

Source versions: GDPR, CS consolidated text including corrigenda (000.003); original act and document history. The consolidation is informative; the published act and applicable corrigenda are authoritative.