Glossary

The General Data Protection Regulation (GDPR) is a comprehensive regulation enacted by the European Union (EU) to safeguard the privacy and security of individuals' personal data. Introduced in May 2018, the GDPR applies to all companies, regardless of their location, that handle the personal data of EU citizens. The regulation aims to empower individuals and give them greater control over their personal information while establishing a consistent framework for data protection across the EU member states. Compliance with the GDPR is essential for organizations operating within the EU or dealing with EU citizens' data.

GDPR requires companies to obtain explicit and informed consent from individuals before collecting and processing their personal data. This consent should be freely given, specific, and unambiguous, ensuring that individuals are fully aware of the purposes for which their data is being collected and used. Transparency is a key principle of the GDPR, necessitating clear and easily understandable privacy notices that outline the data processing activities carried out by the organization.

One of the fundamental rights granted by the GDPR is the right to access and control one's personal data. Individuals have the right to request access to their data, as well as the right to rectify or erase any inaccurate or outdated information. This places an obligation on companies to establish processes and mechanisms that enable individuals to exercise these rights effectively. Additionally, individuals have the right to restrict or object to the processing of their data, as well as the right to data portability, allowing them to transfer their data to another organization.

To ensure the security and protection of personal data, the GDPR mandates that organizations implement appropriate technical and organizational measures. This includes implementing robust data security measures, such as encryption and access controls, to prevent unauthorized access, loss, or theft of data. Privacy by design and privacy by default principles are also emphasized, encouraging organizations to incorporate data protection considerations into their systems and processes from the outset.

Non-compliance with the GDPR can result in severe penalties, including substantial fines of up to 4% of the organization's global annual turnover or €20 million, whichever is higher. Supervisory authorities within each EU member state are responsible for enforcing the GDPR and investigating any data breaches or non-compliance issues. This creates a strong incentive for companies to prioritize data protection and adopt GDPR-compliant practices.