Browse Definitions:
Definition

General Data Protection Regulation (GDPR)

Contributor(s): Trea Lavery
This definition is part of our Essential Guide: What data loss prevention systems and tactics can do now

General Data Protection Regulation (GDPR) is legislation that will update and unify data privacy laws across the European Union. GDPR was approved by the EU Parliament on April 14, 2016 and goes into effect on May 25, 2018.

GDPR replaces the EU Data Protection Directive of 1995. The new directive focuses on keeping businesses more transparent and expanding the privacy rights of data subjects. When a serious data breach has been detected, the company is required by the General Data Protection Regulation to notify all affected people and the supervising authority within 72 hours. Mandates in the General Data Protection Regulation apply to all data produced by EU citizens, whether or not the company collecting the data in question is located within the EU, as well as all people whose data is stored within the EU, whether or not they are actually EU citizens.

Under GDPR, companies may not legally process any person's personally identifiable information without meeting at least one of six conditions.

  1. Express consent of the data subject.
  2. Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract.
  3. Processing is necessary for compliance with a legal obligation.
  4. Processing is necessary to protect the vital interests of a data subject or another person.
  5. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  6. Processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject.

In addition, companies that conduct data processing or monitor data subjects on a large scale must appoint a data protection officer (DPO). The DPO is the figurehead responsible for data governance and ensuring the company complies with GDRP. If a company does not comply with the GDPR when it becomes effective, legal consequences can include fines of up to 20 million euros or 4 percent of annual global turnover.

Under the General Data Protection Regulation, data subject rights include:

Right to be forgotten - data subjects can request personally identifiable data to be erased from a company's storage. The company has the right to refuse requests if they can successfully demonstrate the legal basis for their refusal.

Right of access - data subjects can review the data that an organization has stored about them.

Right to object - data subjects can refuse permission for a company to use or process the subject's personal data. The company can ignore the refusal if they can satisfy one of the legal conditions for processing the subject's personal data, but must notify the subject and explain their reasoning behind doing so.

Right to rectification - data subjects can expect inaccurate personal information to be corrected.

Right of portability - data subjects can access the personal data that a company has about them and transfer it.

Some critics have expressed concern about the United Kingdom's upcoming withdrawal from the EU and wonder whether this will affect the country's compliance with the GDPR. As of this writing, it is expected that the U.K. will update the Data Protection Act 1998 with a new law called the Data Protection Bill 2017. However, because companies in the U.K. often do business with customers or other organizations in EU member states, it is expected that businesses in the U.K. will still need to comply with the General Data Protection Regulation either directly or though an "adequacy test" acceptable to European authorities. 

This was last updated in September 2017

Continue Reading About General Data Protection Regulation (GDPR)

Join the conversation

7 comments

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.

How is your company preparing for GDPR compliance?
Cancel

There is some awkward syntax in this definition.  At the end of the first sentence where it reads:

 "...privacy laws across in the European Union."


It should read either:

"...privacy laws across the European Union."

or

"...privacy laws in the European Union."
Cancel
Thank you! Change made.
Cancel

You are incorrect when you state that "Under GDPR, companies may not store or use any person's personally identifiable information without express consent from that person."

There are six conditions in the legislation that allow the processing of personal data. Consent is just one of them. You only need to satisfy one of them.

The conditions are almost identical to the previous legislation in 1995.

Chris Brogan

Cancel
Thank you Chris!
Cancel
GDPR regulation represents EU’s ‘consumer-first’ commitment and endeavor to tighten privacy control, safeguard the rights of individuals and set up trust among consumers and affiliates. Springbord provides comprehensive database of experts and influencers who are working into GDPR. They deliver information of over 250 industry experts.
Cancel
Totally useless legislation that does not protect privacy of the individual.  Quite the the contrary.  It gives the illusion of privacy.  No company can process private data without express consent unless they have a reason.  Total nonsense.
Cancel

-ADS BY GOOGLE

File Extensions and File Formats

Powered by:

SearchCompliance

  • smart contract

    A smart contract, also known as a cryptocontract, is a computer program that directly controls the transfer of digital currencies...

  • risk map (risk heat map)

    A risk map, also known as a risk heat map, is a data visualization tool for communicating specific risks an organization faces. A...

  • internal audit (IA)

    An internal audit (IA) is an organizational initiative to monitor and analyze its own business operations in order to determine ...

SearchSecurity

SearchHealthIT

SearchDisasterRecovery

  • incident management plan (IMP)

    An incident management plan (IMP), sometimes called an incident response plan or emergency management plan, is a document that ...

  • crisis communication

    Crisis communication is a method of corresponding with people and organizations during a disruptive event to provide them with ...

  • Zerto

    Zerto is a storage software vendor that specializes in enterprise-class business continuity and disaster recovery in virtual and ...

SearchStorage

  • SSD write cycle

    An SSD write cycle is the process of programming data to a NAND flash memory chip in a solid-state storage device.

  • data storage

    Data storage is the collective methods and technologies that capture and retain digital information on electromagnetic, optical ...

  • hard disk

    A hard disk is part of a unit -- often called a disk drive, hard drive or hard disk drive -- that stores and provides relatively ...

SearchSolidStateStorage

  • hybrid hard disk drive (HDD)

    A hybrid hard disk drive is an electromechanical spinning hard disk that contains some amount of NAND Flash memory.

Close