What is GDPR?

Who does GDPR apply to?

GDPR applies to processing in the context of an EU establishment's activities, even if the processing itself happens elsewhere. It can also apply to organizations outside the EU when their relevant processing relates to offering goods or services to people in the EU, or monitoring their behavior there (Article 3).

Having a website that someone in Europe can visit is not, by itself, the same as targeting people there. Assess the facts of your activities. Small companies are not automatically exempt: particular obligations and exceptions depend on what data you process and how.

What counts as personal data?

Personal data is information relating to an identified or identifiable natural person. Names, customer email addresses, employee records and online identifiers may qualify. Information can be personal data even when it identifies someone indirectly through a combination of details.

Processing includes collecting, storing, using, sharing and deleting data. Pseudonymized data can remain personal data if a person can be identified using additional information. Truly anonymous data falls outside GDPR, but removing a name does not necessarily make a record anonymous.

Special categories, such as health data or data revealing certain sensitive characteristics, need additional protections and a relevant Article 9 condition. Criminal-conviction data is addressed separately under Article 10.

GDPR's core data protection principles

Article 5 sets out the principles, and accountability requires the controller to be able to demonstrate compliance.

• Lawfulness, fairness and transparency.
• Purpose limitation: use data for specified, legitimate purposes.
• Data minimization: collect only what is needed.
• Accuracy: keep information appropriately accurate and current.
• Storage limitation: do not retain identifiable data longer than necessary.
• Integrity and confidentiality: apply appropriate security.
• Accountability: take responsibility and keep evidence of compliance.

Consent is not the only lawful basis

Article 6 provides six lawful bases: consent, contract, legal obligation, vital interests, a task in the public interest or official authority, and legitimate interests. Identify a suitable basis for each purpose before processing; do not choose consent simply because a checkbox is easy to add.

Consent must be freely given, specific, informed and unambiguous, and withdrawal must be as easy as giving it. Legitimate interests requires assessment and has limits. Special-category processing also needs an Article 9 condition. Explain relevant processing clearly in privacy information.

What rights do individuals have?

GDPR provides rights to information, access, rectification, erasure, restriction, data portability and objection, plus protections concerning certain solely automated decisions. Some rights depend on conditions and exceptions; erasure is not an unconditional demand to delete every record.

Organizations generally must respond to rights requests without undue delay and within one month. An extension of up to two further months may apply because of complexity or the number of requests, with notification and reasons within the first month (Article 12). Build a process for identifying, checking and handling requests rather than leaving them in an inbox.

Controllers, processors and business responsibilities

A controller determines the purposes and means of processing. A processor handles personal data on the controller's behalf. Roles depend on actual activities, not simply the label in a contract. Controller–processor arrangements need to satisfy Article 28 where it applies.

Maintain records of processing where required, apply appropriate security and assess processing likely to result in high risk through a data protection impact assessment (DPIA). A data protection officer (DPO) is required in specified circumstances, not for every business. Transfers outside the EEA may require a valid Chapter V mechanism and additional assessment.

A controller must notify the supervisory authority of a personal-data breach without undue delay and, where feasible, within 72 hours of becoming aware, unless it is unlikely to result in a risk to individuals' rights and freedoms (Article 33). Inform affected people without undue delay when the breach is likely to result in a high risk, subject to Article 34's exceptions. A processor notifies its controller without undue delay.

How to start GDPR compliance work

Treat privacy as part of everyday operations, with named owners and evidence. Begin with a clear picture of your processing:

• 1. Map what personal data you use, its purposes, recipients and retention.
• 2. Assess GDPR scope and identify controller and processor roles.
• 3. Record lawful bases and update privacy information.
• 4. Review processor contracts, access controls and relevant transfers.
• 5. Establish rights-request and breach-response processes.
• 6. Assess DPIA and DPO requirements for your activities.
• 7. Train people, monitor changes and review your records regularly.

What happens if an organization does not comply?

Supervisory authorities can investigate, issue corrective orders and impose administrative fines. Depending on the infringement, Article 83 provides maximum tiers of €10 million or 2% of worldwide annual turnover, and €20 million or 4%, whichever is higher. These are ceilings, not automatic fines for every incident.

Regulators consider circumstances including the nature, gravity and duration of the infringement and the organization's response. Individuals may also have rights to compensation. Qualified legal advice is important when assessing your specific obligations.

How ComplyEncrypt supports GDPR work

ComplyEncrypt offers guided privacy documentation, records of processing, DPIA and data-subject request workflows, and consent management. It helps your team organize recurring privacy work instead of treating compliance as a single policy document.

Our 90% automation claim refers to documentation only. Your organization decides lawful bases, validates assessments, implements safeguards and handles requests and notifications. Software does not establish legal compliance or replace qualified legal advice.