Overview
Direct Answer
The General Data Protection Regulation is EU legislation that establishes comprehensive rules for the collection, processing, and storage of personal data belonging to residents of EU member states and the EEA. It grants individuals enforceable rights over their data and imposes legal obligations on organisations that handle such information.
How It Works
The regulation operates through a consent and lawful basis framework requiring organisations to document processing activities, conduct data protection impact assessments, and implement privacy-by-design principles. It establishes roles including data controllers (who determine processing purposes) and processors (who handle data on behalf of controllers), with documented contracts mandating specific safeguards and breach notification protocols within 72 hours of discovery.
Why It Matters
Non-compliance carries fines up to €20 million or 4% of global annual turnover, creating substantial financial and reputational risk. Organisations operating across borders or handling EU resident data must embed compliance into operations, affecting data architecture, consent management, and vendor selection decisions.
Common Applications
Manufacturing firms collecting employee data, e-commerce platforms processing customer information, cloud service providers handling EU resident records, and financial institutions managing customer databases all fall under its scope. Healthcare organisations and marketing agencies managing personal data are particularly heavily regulated.
Key Considerations
The regulation applies extraterritorially to non-EU organisations processing EU resident data, creating compliance obligations regardless of organisational location. Balancing legitimate business interests with individual rights requires ongoing legal interpretation, as enforcement approaches vary across member state authorities.
Referenced By1 term mentions GDPR
Other entries in the wiki whose definition references GDPR — useful for understanding how this concept connects across Governance, Risk & Compliance and adjacent domains.
More in Governance, Risk & Compliance
EU AI Act
Compliance & RegulationThe European Union's comprehensive legislation establishing rules for the development and use of AI systems based on risk levels.
Know Your Customer
Risk ManagementThe process of verifying the identity, suitability, and risks of customers in financial transactions.
AI Risk Management Framework
GovernanceA structured approach to identifying, assessing, and mitigating risks associated with AI systems, as defined by standards such as NIST AI RMF and ISO/IEC 42001.
Compliance as Code
Compliance & RegulationThe practice of expressing regulatory and security compliance requirements as machine-readable policies that can be automatically validated against infrastructure and application configurations.
Third-Party Risk Management
Risk ManagementThe process of identifying and mitigating risks associated with outsourcing to third-party vendors.
Governance
GovernanceThe system of policies, rules, and processes by which activities are directed, controlled, and managed.
Model Risk Management
GovernanceThe governance framework for identifying, measuring, and mitigating risks arising from AI and analytical models.
Responsible AI
GovernanceThe practice of designing, developing, and deploying AI systems with good intention and ethical principles.