GDPR (GDPR)
The EU General Data Protection Regulation (2016/679), the main EU law on personal data, applying since May 2018.
Overview
The GDPR sets principles for processing personal data, lawful bases for processing, individuals’ rights, controller and processor duties, breach notification within 72 hours, international transfer rules and fines of up to 4% of global annual turnover for the most serious breaches.
It applies to organisations established in the EU and to those outside it that offer goods or services to, or monitor, people in the EU. It is enforced by national data protection authorities coordinated through the EDPB.
As primary legislation it is binding law; regulators fill in and interpret its detail through rules, guidance and supervisory practice. The authorities most closely connected to it are EDPB, CNIL, DPC, AEPD and BfDI. It is often read together with UK GDPR.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
It set the global benchmark for privacy law and carries some of the largest fines in any regime.
Who it affects
Any organisation processing personal data of people in the EU.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to GDPR. Select one to open it.
What to do about it
- 1Confirm whether you are in scope: who it covers, which activities and where.
- 2Break it into testable requirements.
- 3Map each requirement to a control and an owner.
- 4Track amendments, implementing rules and guidance.
- 5Keep sealed evidence for every control run.
From requirement to evidence.
GDPR obligations are mapped to a shared privacy control set, alongside UK GDPR, PIPEDA and US state laws.
Request early access →