GDPR

GDPR (General Data Protection Regulation) is the EU's comprehensive data privacy law that governs how organizations collect, process, and protect personal data of EU residents.

The General Data Protection Regulation is a regulation in EU law on data protection and privacy. It applies to any organization that processes personal data of EU residents, regardless of where the organization is located.

Key GDPR principles include: - Lawfulness, fairness, transparency: Clear legal basis and transparency - Purpose limitation: Data collected for specified purposes only - Data minimization: Only collect necessary data - Accuracy: Keep data accurate and up to date - Storage limitation: Don't keep data longer than needed - Integrity and confidentiality: Appropriate security measures - Accountability: Demonstrate compliance

GDPR grants individuals specific rights: - Right to access their data - Right to rectification - Right to erasure ("right to be forgotten") - Right to data portability - Right to object to processing

Non-compliance can result in fines up to €20 million or 4% of global annual revenue.

Why It Matters

GDPR fines have exceeded €4 billion since enforcement began, with penalties reaching 4% of global revenue. Any company serving EU customers—including US-based SaaS companies—must comply. Beyond fines, GDPR non-compliance blocks market access to the EU's 450 million consumers and damages trust with privacy-conscious customers worldwide. Implementing GDPR-aligned data practices is now a competitive advantage in global markets.

Key Points

Applies to any organization processing EU resident data

Grants individuals extensive data rights

Requires clear consent and legal basis for processing

Fines up to 4% of global revenue or €20 million

Requires Data Protection Officer for certain organizations

Applicable Compliance Frameworks

GDPR

Related Terms

Data Privacy

Data privacy refers to the proper handling of personal information including how it is collected, used, shared, and protected in compliance with regulations.

Encryption at Rest

Encryption at rest protects data stored on disks, databases, or storage systems by converting it to an unreadable format that requires a key to decrypt.

SOC 2 vs GDPR