Browse Definitions:
Definition

General Data Protection Regulation (GDPR)

This definition is part of our Essential Guide: What data loss prevention systems and tactics can do now
Contributor(s): Trea Lavery

General Data Protection Regulation (GDPR) is legislation that will update and unify data privacy laws across in the European Union. GDPR was approved by the EU Parliament on April 14, 2016 and goes into effect on May 25, 2018.

GDPR replaces the EU Data Protection Directive of 1995. The new directive focuses on keeping businesses more transparent and expanding the privacy rights of data subjects. When a serious data breach has been detected, the company is required by the General Data Protection Regulation to notify all affected people and the supervising authority within 72 hours. Mandates in the General Data Protection Regulation apply to all data produced by EU citizens, whether or not the company collecting the data in question is located within the EU, as well as all people whose data is stored within the EU, whether or not they are actually EU citizens.

Under GDPR, companies may not legally process any person's personally identifiable information without meeting at least one of six conditions.

  1. Express consent of the data subject.
  2. Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract.
  3. Processing is necessary for compliance with a legal obligation.
  4. Processing is necessary to protect the vital interests of a data subject or another person.
  5. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  6. Processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject.

In addition, companies that conduct data processing or monitor data subjects on a large scale must appoint a data protection officer (DPO). The DPO is the figurehead responsible for data governance and ensuring the company complies with GDRP. If a company does not comply with the GDPR when it becomes effective, legal consequences can include fines of up to 20 million euros or 4 percent of annual global turnover.

Under the General Data Protection Regulation, data subject rights include:

Right to be forgotten - data subjects can request personally identifiable data to be erased from a company's storage. The company has the right to refuse requests if they can successfully demonstrate the legal basis for their refusal.

Right of access - data subjects can review the data that an organization has stored about them.

Right to object - data subjects can refuse permission for a company to use or process the subject's personal data. The company can ignore the refusal if they can satisfy one of the legal conditions for processing the subject's personal data, but must notify the subject and explain their reasoning behind doing so.

Right to rectification - data subjects can expect inaccurate personal information to be corrected.

Right of portability - data subjects can access the personal data that a company has about them and transfer it.

Some critics have expressed concern about the United Kingdom's upcoming withdrawal from the EU and wonder whether this will affect the country's compliance with the GDPR. As of this writing, it is expected that the U.K. will update the Data Protection Act 1998 with a new law called the Data Protection Bill 2017. However, because companies in the U.K. often do business with customers or other organizations in EU member states, it is expected that businesses in the U.K. will still need to comply with the General Data Protection Regulation either directly or though an "adequacy test" acceptable to European authorities. 

This was last updated in September 2017

Continue Reading About General Data Protection Regulation (GDPR)

Join the conversation

3 comments

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.

How is your company preparing for GDPR compliance?
Cancel

There is some awkward syntax in this definition.  At the end of the first sentence where it reads:

 "...privacy laws across in the European Union."


It should read either:

"...privacy laws across the European Union."

or

"...privacy laws in the European Union."
Cancel

You are incorrect when you state that "Under GDPR, companies may not store or use any person's personally identifiable information without express consent from that person."

There are six conditions in the legislation that allow the processing of personal data. Consent is just one of them. You only need to satisfy one of them.

The conditions are almost identical to the previous legislation in 1995.

Chris Brogan

Cancel

-ADS BY GOOGLE

File Extensions and File Formats

Powered by:

SearchCompliance

  • internal audit (IA)

    An internal audit (IA) is an organizational initiative to monitor and analyze its own business operations in order to determine ...

  • pure risk (absolute risk)

    Pure risk, also called absolute risk, is a category of threat that is beyond human control and has only one possible outcome if ...

  • risk assessment

    Risk assessment is the identification of hazards that could negatively impact an organization's ability to conduct business.

SearchSecurity

  • principle of least privilege (POLP)

    The principle of least privilege (POLP), an important concept in computer security, is the practice of limiting access rights for...

  • identity management (ID management)

    Identity management (ID management) is the organizational process for identifying, authenticating and authorizing individuals or ...

  • zero-day (computer)

    A zero-day vulnerability, also known as a computer zero day, is a flaw in software, hardware or firmware that is unknown to the ...

SearchHealthIT

SearchDisasterRecovery

  • business continuity and disaster recovery (BCDR)

    Business continuity and disaster recovery (BCDR) are closely related practices that describe an organization's preparation for ...

  • business continuity plan (BCP)

    A business continuity plan (BCP) is a document that consists of the critical information an organization needs to continue ...

  • call tree

    A call tree -- sometimes referred to as a phone tree -- is a telecommunications chain for notifying specific individuals of an ...

SearchStorage

  • SAS SSD (Serial-Attached SCSI solid-state drive)

    A SAS SSD (Serial-Attached SCSI solid-state drive) is a NAND flash-based storage or caching device designed to fit in the same ...

  • MTTR (mean time to repair)

    MTTR (mean time to repair) is the average time required to fix a failed component or device and return it to production status.

  • OpenStack Swift

    OpenStack Swift, also known as OpenStack Object Storage, is an open source object storage system that is licensed under the ...

SearchSolidStateStorage

  • hybrid hard disk drive (HDD)

    A hybrid hard disk drive is an electromechanical spinning hard disk that contains some amount of NAND Flash memory.

Close