Browse Definitions :
Definition

General Data Protection Regulation (GDPR)

Contributor(s): Trea Lavery
This definition is part of our Essential Guide: What data loss prevention systems and tactics can do now

General Data Protection Regulation (GDPR) is legislation that will update and unify data privacy laws across the European Union. GDPR was approved by the EU Parliament on April 14, 2016 and goes into effect on May 25, 2018.

GDPR replaces the EU Data Protection Directive of 1995. The new directive focuses on keeping businesses more transparent and expanding the privacy rights of data subjects. When a serious data breach has been detected, the company is required by the General Data Protection Regulation to notify all affected people and the supervising authority within 72 hours. Mandates in the General Data Protection Regulation apply to all data produced by EU citizens, whether or not the company collecting the data in question is located within the EU, as well as all people whose data is stored within the EU, whether or not they are actually EU citizens.

Under GDPR, companies may not legally process any person's personally identifiable information without meeting at least one of six conditions.

  1. Express consent of the data subject.
  2. Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract.
  3. Processing is necessary for compliance with a legal obligation.
  4. Processing is necessary to protect the vital interests of a data subject or another person.
  5. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  6. Processing is necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject.

In addition, companies that conduct data processing or monitor data subjects on a large scale must appoint a data protection officer (DPO). The DPO is the figurehead responsible for data governance and ensuring the company complies with GDRP. If a company does not comply with the GDPR when it becomes effective, legal consequences can include fines of up to 20 million euros or 4 percent of annual global turnover.

Under the General Data Protection Regulation, data subject rights include:

Right to be forgotten - data subjects can request personally identifiable data to be erased from a company's storage. The company has the right to refuse requests if they can successfully demonstrate the legal basis for their refusal.

Right of access - data subjects can review the data that an organization has stored about them.

Right to object - data subjects can refuse permission for a company to use or process the subject's personal data. The company can ignore the refusal if they can satisfy one of the legal conditions for processing the subject's personal data, but must notify the subject and explain their reasoning behind doing so.

Right to rectification - data subjects can expect inaccurate personal information to be corrected.

Right of portability - data subjects can access the personal data that a company has about them and transfer it.

Some critics have expressed concern about the United Kingdom's upcoming withdrawal from the EU and wonder whether this will affect the country's compliance with the GDPR. As of this writing, it is expected that the U.K. will update the Data Protection Act 1998 with a new law called the Data Protection Bill 2017. However, because companies in the U.K. often do business with customers or other organizations in EU member states, it is expected that businesses in the U.K. will still need to comply with the General Data Protection Regulation either directly or though an "adequacy test" acceptable to European authorities. 

This was last updated in September 2017

Continue Reading About General Data Protection Regulation (GDPR)

Join the conversation

7 comments

Send me notifications when other members comment.

Please create a username to comment.

How is your company preparing for GDPR compliance?
Cancel

There is some awkward syntax in this definition.  At the end of the first sentence where it reads:

 "...privacy laws across in the European Union."


It should read either:

"...privacy laws across the European Union."

or

"...privacy laws in the European Union."
Cancel
Thank you! Change made.
Cancel

You are incorrect when you state that "Under GDPR, companies may not store or use any person's personally identifiable information without express consent from that person."

There are six conditions in the legislation that allow the processing of personal data. Consent is just one of them. You only need to satisfy one of them.

The conditions are almost identical to the previous legislation in 1995.

Chris Brogan

Cancel
Thank you Chris!
Cancel
GDPR regulation represents EU’s ‘consumer-first’ commitment and endeavor to tighten privacy control, safeguard the rights of individuals and set up trust among consumers and affiliates. Springbord provides comprehensive database of experts and influencers who are working into GDPR. They deliver information of over 250 industry experts.
Cancel
Totally useless legislation that does not protect privacy of the individual.  Quite the the contrary.  It gives the illusion of privacy.  No company can process private data without express consent unless they have a reason.  Total nonsense.
Cancel

-ADS BY GOOGLE

File Extensions and File Formats

Powered by:

SearchCompliance

  • Whistleblower Protection Act

    The Whistleblower Protection Act of 1989 is a law that protects federal government employees in the United States from ...

  • smart contract

    A smart contract, also known as a cryptocontract, is a computer program that directly controls the transfer of digital currencies...

  • risk map (risk heat map)

    A risk map, also known as a risk heat map, is a data visualization tool for communicating specific risks an organization faces. A...

SearchSecurity

  • certificate authority (CA)

    A certificate authority (CA) is a trusted entity that issues digital certificates, which are data files used to cryptographically...

  • hacktivism

    Hacktivism is the act of hacking, or breaking into a computer system, for a politically or socially motivated purpose.

  • advanced persistent threat (APT)

    An advanced persistent threat (APT) is a prolonged and targeted cyberattack in which an intruder gains access to a network and ...

SearchHealthIT

  • Cerner Corp.

    Cerner Corp. is a public company in North Kansas City, Mo., that provides various health information technologies, ranging from ...

  • clinical decision support system (CDSS)

    A clinical decision support system (CDSS) is an application that analyzes data to help healthcare providers make decisions and ...

  • Health IT (health information technology)

    Health IT (health information technology) is the area of IT involving the design, development, creation, use and maintenance of ...

SearchDisasterRecovery

  • tabletop exercise (TTX)

    A tabletop exercise (TTX) is a disaster preparedness activity that takes participants through the process of dealing with a ...

  • risk mitigation

    Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a data center.

  • ransomware recovery

    Ransomware recovery is the process of resuming options following a cyberattack that demands payment in exchange for unlocking ...

SearchStorage

  • SSD (solid-state drive)

    An SSD (solid-state drive) is a type of nonvolatile storage media that stores persistent data on solid-state flash memory.

  • file system

    In a computer, a file system -- sometimes written filesystem -- is the way in which files are named and where they are placed ...

  • storage virtualization

    Storage virtualization is the pooling of physical storage from multiple storage devices into what appears to be a single storage ...

Close