Browse Definitions :
Definition

General Data Protection Regulation (GDPR)

Contributor(s): Trea Lavery
This definition is part of our Essential Guide: What data loss prevention systems and tactics can do now

General Data Protection Regulation (GDPR) is legislation that will update and unify data privacy laws across the European Union. GDPR was approved by the EU Parliament on April 14, 2016 and goes into effect on May 25, 2018.

GDPR replaces the EU Data Protection Directive of 1995. The new directive focuses on keeping businesses more transparent and expanding the privacy rights of data subjects. When a serious data breach has been detected, the company is required by the General Data Protection Regulation to notify all affected people and the supervising authority within 72 hours. Mandates in the General Data Protection Regulation apply to all data produced by EU citizens, whether or not the company collecting the data in question is located within the EU, as well as all people whose data is stored within the EU, whether or not they are actually EU citizens.

Under GDPR, companies may not legally process any person's personally identifiable information without meeting at least one of six conditions.

  1. Express consent of the data subject.
  2. Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract.
  3. Processing is necessary for compliance with a legal obligation.
  4. Processing is necessary to protect the vital interests of a data subject or another person.
  5. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  6. Processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject.

In addition, companies that conduct data processing or monitor data subjects on a large scale must appoint a data protection officer (DPO). The DPO is the figurehead responsible for data governance and ensuring the company complies with GDRP. If a company does not comply with the GDPR when it becomes effective, legal consequences can include fines of up to 20 million euros or 4 percent of annual global turnover.

Under the General Data Protection Regulation, data subject rights include:

Right to be forgotten - data subjects can request personally identifiable data to be erased from a company's storage. The company has the right to refuse requests if they can successfully demonstrate the legal basis for their refusal.

Right of access - data subjects can review the data that an organization has stored about them.

Right to object - data subjects can refuse permission for a company to use or process the subject's personal data. The company can ignore the refusal if they can satisfy one of the legal conditions for processing the subject's personal data, but must notify the subject and explain their reasoning behind doing so.

Right to rectification - data subjects can expect inaccurate personal information to be corrected.

Right of portability - data subjects can access the personal data that a company has about them and transfer it.

Some critics have expressed concern about the United Kingdom's upcoming withdrawal from the EU and wonder whether this will affect the country's compliance with the GDPR. As of this writing, it is expected that the U.K. will update the Data Protection Act 1998 with a new law called the Data Protection Bill 2017. However, because companies in the U.K. often do business with customers or other organizations in EU member states, it is expected that businesses in the U.K. will still need to comply with the General Data Protection Regulation either directly or though an "adequacy test" acceptable to European authorities. 

This was last updated in September 2017

Continue Reading About General Data Protection Regulation (GDPR)

Join the conversation

8 comments

Send me notifications when other members comment.

Please create a username to comment.

How is your company preparing for GDPR compliance?
Cancel

There is some awkward syntax in this definition.  At the end of the first sentence where it reads:

 "...privacy laws across in the European Union."


It should read either:

"...privacy laws across the European Union."

or

"...privacy laws in the European Union."
Cancel
Thank you! Change made.
Cancel

You are incorrect when you state that "Under GDPR, companies may not store or use any person's personally identifiable information without express consent from that person."

There are six conditions in the legislation that allow the processing of personal data. Consent is just one of them. You only need to satisfy one of them.

The conditions are almost identical to the previous legislation in 1995.

Chris Brogan

Cancel
Thank you Chris!
Cancel
GDPR regulation represents EU’s ‘consumer-first’ commitment and endeavor to tighten privacy control, safeguard the rights of individuals and set up trust among consumers and affiliates. Springbord provides comprehensive database of experts and influencers who are working into GDPR. They deliver information of over 250 industry experts.
Cancel
Totally useless legislation that does not protect privacy of the individual.  Quite the the contrary.  It gives the illusion of privacy.  No company can process private data without express consent unless they have a reason.  Total nonsense.
Cancel
Is TechTarget GDPR compliant? I would like to delete my account.
Cancel

-ADS BY GOOGLE

File Extensions and File Formats

Powered by:

SearchCompliance

  • compliance audit

    A compliance audit is a comprehensive review of an organization's adherence to regulatory guidelines.

  • regulatory compliance

    Regulatory compliance is an organization's adherence to laws, regulations, guidelines and specifications relevant to its business...

  • Whistleblower Protection Act

    The Whistleblower Protection Act of 1989 is a law that protects federal government employees in the United States from ...

SearchSecurity

  • RSA algorithm (Rivest-Shamir-Adleman)

    The RSA algorithm is the basis of a cryptosystem -- a suite of cryptographic algorithms that are used for specific security ...

  • remote access

    Remote access is the ability to access a computer or a network remotely through a network connection.

  • IP Spoofing

    IP spoofing is the crafting of Internet Protocol (IP) packets with a source IP address that has been modified to impersonate ...

SearchHealthIT

SearchDisasterRecovery

  • network disaster recovery plan

    A network disaster recovery plan is a set of procedures designed to prepare an organization to respond to an interruption of ...

  • virtual disaster recovery

    Virtual disaster recovery is a type of DR that typically involves replication and allows a user to fail over to virtualized ...

  • tabletop exercise (TTX)

    A tabletop exercise (TTX) is a disaster preparedness activity that takes participants through the process of dealing with a ...

SearchStorage

  • disk array

    A disk array, also called a storage array, is a data storage system used for block-based storage, file-based storage or object ...

  • enterprise storage

    Enterprise storage is a centralized repository for business information that provides common data management, protection and data...

  • optical storage

    Optical storage is any storage type in which data is written and read with a laser. Typically, data is written to optical media, ...

Close