What Is GDPR?
The General Data Protection Regulation (GDPR) is the European Union's data protection regulation, Regulation (EU) 2016/679. It applies from 25 May 2018 (Article 99(2)) and replaced the 1995 Data Protection Directive (Directive 95/46/EC).
The GDPR sets rules for how organisations collect, process, store and share personal data, and gives individuals rights over that data. This guide cites the Article for each statement so you can check it against the Regulation.
Who Does GDPR Apply To?
GDPR has an intentionally broad territorial scope under Article 3:
- Organizations established in the EU that process personal data, regardless of where the processing takes place
- Organizations outside the EU that offer goods or services to individuals in the EU (even if no payment is required)
- Organizations outside the EU that monitor the behavior of individuals within the EU (such as tracking website visitors or profiling)
The regulation applies to both data controllers (organizations that determine the purposes and means of processing) and data processors (organizations that process data on behalf of controllers) (Article 4(7)–(8)).
Key GDPR Principles
Article 5 of the GDPR establishes seven foundational principles that govern all personal data processing. These principles are not merely aspirational — they carry legal obligations and form the basis for enforcement actions.
1. Lawfulness, Fairness, and Transparency
Personal data must be processed lawfully, fairly, and in a transparent manner. Organizations must have a valid legal basis for processing, must not process data in ways that are unduly detrimental or unexpected, and must be clear and open about how they use personal data.
2. Purpose Limitation
Data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. Organizations must define and document the purpose of data collection before processing begins.
3. Data Minimization
Only personal data that is adequate, relevant, and limited to what is necessary for the stated purpose should be collected and processed. Organizations should regularly review data holdings and delete unnecessary data.
4. Accuracy
Personal data must be accurate and, where necessary, kept up to date. Organizations must take reasonable steps to ensure inaccurate data is erased or rectified without delay.
5. Storage Limitation
Personal data must be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which it is processed. Organizations need clear data retention policies and schedules.
6. Integrity and Confidentiality
Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organizational measures.
7. Accountability
The controller is responsible for — and must be able to demonstrate — compliance with all of the above principles. This is a critical shift from previous data protection law: it is not enough to simply comply; organizations must actively prove their compliance through documentation, impact assessments, and governance structures.
Lawful Bases for Processing
Under Article 6, organizations must identify and document a lawful basis before processing personal data. There are six lawful bases:
1. Consent
The data subject has given clear, affirmative consent for processing their personal data for one or more specific purposes. GDPR sets a high bar for consent — it must be freely given, specific, informed, and unambiguous. Pre-ticked boxes and bundled consent are not valid. Data subjects must be able to withdraw consent as easily as they gave it.
2. Contract
Processing is necessary for the performance of a contract with the data subject or to take steps at the data subject's request before entering into a contract. This covers scenarios such as processing delivery addresses for online orders or payment information to complete transactions.
3. Legal Obligation
Processing is necessary for compliance with a legal obligation to which the controller is subject. Examples include tax reporting requirements, employment law obligations, and anti-money laundering regulations.
4. Vital Interests
Processing is necessary to protect the vital interests of the data subject or another natural person. This basis is narrow and typically applies only in life-or-death situations, such as medical emergencies.
5. Public Interest
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This basis is primarily relevant to public authorities and organizations carrying out public functions.
6. Legitimate Interests
Processing is necessary for the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights, and freedoms of the data subject (Article 6(1)(f)). The balancing test should be documented, for example through a Legitimate Interests Assessment.
Data Subject Rights
GDPR grants individuals rights over their personal data. Controllers must respond to requests without undue delay and in any event within one month, extendable by two further months where necessary for complex requests (Article 12(3)).
Right of Access (Article 15)
Data subjects have the right to obtain confirmation of whether their data is being processed and, if so, to access the personal data and supplementary information including the purposes of processing, categories of data, recipients, retention periods, and the source of the data.
Right to Rectification (Article 16)
Data subjects can request the correction of inaccurate personal data and the completion of incomplete data.
Right to Erasure / Right to Be Forgotten (Article 17)
Data subjects can request the deletion of their personal data in certain circumstances, including when the data is no longer necessary, consent is withdrawn, or processing is unlawful. This right is not absolute — organizations may retain data where required by legal obligation or for the establishment, exercise, or defense of legal claims.
Right to Restriction of Processing (Article 18)
Data subjects can request that processing of their data be restricted in specific circumstances, such as when the accuracy of data is contested or when processing is unlawful but the subject opposes erasure.
Right to Data Portability (Article 20)
Data subjects have the right to receive their personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller without hindrance. This right applies when processing is based on consent or contract and is carried out by automated means.
Right to Object (Article 21)
Data subjects have the right to object to processing based on legitimate interests or public interest, including profiling. For direct marketing, the right to object is absolute — processing must cease immediately upon objection.
Rights Related to Automated Decision-Making (Article 22)
Data subjects have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects. Where automated decision-making is used, organizations must provide meaningful information about the logic involved and the significance and consequences of such processing.
Data Protection Officer (DPO)
When a DPO Is Required
Under Article 37, appointing a Data Protection Officer is mandatory when:
- The processing is carried out by a public authority or body
- The organization's core activities require regular and systematic monitoring of data subjects on a large scale
- The organization's core activities involve large-scale processing of special categories of data (e.g., health data, biometric data) or data relating to criminal convictions and offenses
An organisation may also appoint a DPO voluntarily; the GDPR's DPO provisions apply where it does.
DPO Responsibilities
The DPO's tasks include:
- Informing and advising the organization on GDPR obligations
- Monitoring compliance, including staff training and internal audits
- Advising on Data Protection Impact Assessments (DPIAs)
- Cooperating with the supervisory authority and acting as a point of contact
- Considering the risks associated with processing operations
The DPO must be independent, report to the highest level of management, and not be penalized for performing their duties.
Data Protection Impact Assessments (DPIAs)
When a DPIA Is Required
Under Article 35, a DPIA is required when processing is likely to result in a high risk to the rights and freedoms of individuals. Specific scenarios include:
- Systematic and extensive profiling with significant effects
- Large-scale processing of special categories of data
- Systematic monitoring of a publicly accessible area on a large scale
- Use of new technologies that may present elevated risks
- Automated decision-making with legal or similarly significant effects
How to Conduct a DPIA
A DPIA must contain at minimum:
- A systematic description of the processing operations and their purposes
- An assessment of the necessity and proportionality of the processing
- An assessment of the risks to the rights and freedoms of data subjects
- The measures envisaged to address risks, including safeguards and security measures
If the DPIA reveals high risks that cannot be sufficiently mitigated, the organization must consult the relevant supervisory authority before proceeding with processing.
Records of Processing Activities (ROPA)
Article 30 requires both controllers and processors to maintain written records of their processing activities. This is a core accountability requirement.
Controller ROPA Must Include:
- Name and contact details of the controller and DPO
- Purposes of processing
- Description of categories of data subjects and personal data
- Categories of recipients of the data
- Details of transfers to third countries and safeguards
- Retention periods for each category of data
- General description of technical and organizational security measures
Processor ROPA Must Include:
- Name and contact details of the processor and each controller on whose behalf they act
- Categories of processing carried out on behalf of each controller
- Details of transfers to third countries
- General description of technical and organizational security measures
ROPA must be maintained in writing (including electronic form) and made available to the supervisory authority upon request.
Cross-Border Data Transfers
Transferring personal data outside the European Economic Area (EEA) is restricted under GDPR unless adequate protections are in place.
Adequacy Decisions
The European Commission can determine that a third country or international organisation provides an adequate level of data protection (Article 45). Transfers to a country covered by an adequacy decision can proceed without additional safeguards.
Standard Contractual Clauses (SCCs)
In the absence of an adequacy decision, organizations can rely on Standard Contractual Clauses — contractual terms adopted by the European Commission under Article 46(2)(c). The current clauses use a modular approach covering different transfer scenarios (controller-to-controller, controller-to-processor, processor-to-processor and processor-to-controller).
Binding Corporate Rules (BCRs)
BCRs are internal rules adopted by multinational groups for transferring personal data within the group to entities located outside the EEA. BCRs must be approved by the relevant supervisory authority and provide enforceable data subject rights.
Impact of Schrems II
The Court of Justice of the European Union's Schrems II judgment (Case C-311/18) invalidated the EU-U.S. Privacy Shield and imposed additional obligations on organizations relying on SCCs. Organizations should conduct a Transfer Impact Assessment (TIA) to evaluate whether the laws of the recipient country provide essentially equivalent protection and, where they do not, consider supplementary measures.
Data Breach Notification
GDPR imposes strict breach notification requirements under Articles 33 and 34.
72-Hour Rule
Controllers must notify the relevant supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. If notification is delayed beyond 72 hours, the controller must provide a reasoned justification.
The notification must include:
- Nature of the breach, including approximate number of individuals and records affected
- Name and contact details of the DPO or other contact point
- Description of likely consequences
- Description of measures taken or proposed to address the breach
Data Subject Notification
When a breach is likely to result in a high risk to the rights and freedoms of individuals, the controller must also communicate the breach to affected data subjects without undue delay. This notification must be in clear and plain language and describe the nature of the breach and the steps individuals can take to protect themselves.
Data subject notification is not required if the controller has implemented appropriate protective measures (such as encryption) that render the data unintelligible, has taken subsequent measures to ensure the high risk is no longer likely to materialize, or if individual notification would involve disproportionate effort (in which case a public communication is required).
GDPR Penalties
Penalty structure
GDPR penalties are divided into two tiers:
- Lower tier — Up to €10 million or 2% of annual global turnover (whichever is greater) for violations related to obligations of controllers and processors, certification bodies, and monitoring bodies.
- Upper tier — Up to €20 million or 4% of annual global turnover (whichever is greater) for violations of data processing principles, conditions for consent, data subject rights, and cross-border transfer requirements.
Supervisory authorities also have corrective powers under Article 58(2), including ordering processing to be limited or stopped.
How Compliance Enablers supports GDPR
GDPR is one of Compliance Enablers' 30 standards, run as a guided programme: scoping, assessment, scoring, evidence and readiness. The platform includes 60 dashboard modules in 11 groups, all included in every plan. Controls, evidence and findings map across standards through thousands of curated crosswalk mappings. We help you prepare; the supervisory-authority and assurance decisions belong to the independent bodies.
See how Compliance Enablers runs standards as guided programmes →
GDPR Compliance Checklist
Use this checklist to assess your GDPR compliance posture:
- [ ] Lawful basis identified and documented for each processing activity
- [ ] Privacy notices updated and transparent (Articles 13 and 14)
- [ ] Consent mechanisms meet GDPR requirements (freely given, specific, informed, unambiguous)
- [ ] Data subject rights processes established (access, rectification, erasure, portability, objection)
- [ ] Data Protection Officer appointed (if required)
- [ ] Record of Processing Activities (ROPA) maintained
- [ ] Data Protection Impact Assessments conducted for high-risk processing
- [ ] Data Processing Agreements in place with all processors
- [ ] Cross-border transfer mechanisms established (SCCs, adequacy decisions, BCRs)
- [ ] Transfer Impact Assessments completed for non-adequate countries
- [ ] Data breach notification procedures documented (72-hour supervisory authority notification)
- [ ] Data retention policy and schedule implemented
- [ ] Data minimization practices reviewed and enforced
- [ ] Security measures appropriate to risk (encryption, access controls, pseudonymization)
- [ ] Staff training on data protection completed and documented
- [ ] Regular compliance audits and reviews scheduled