General Data Protection Regulation (GDPR)

General Data Protection Regulation (GDPR) is a comprehensive data protection and privacy law introduced by the European Union (EU) on May 25, 2018. The primary purpose of GDPR is to protect the privacy and personal data of EU citizens and residents by regulating how organizations handle and process their data. 

Fundamental principles of GDPR include:

• Lawfulness, fairness, and transparency: Data processing must have a legal basis and be done fairly, and individuals must be informed about how their data is used.
• Purpose limitation: Data must be collected for specific and legitimate purposes and not used in ways that are incompatible with those purposes.
• Data minimization: Organizations should only collect and retain the minimum personal data necessary to achieve their stated purpose.
• Accuracy: Data must be accurate and kept up to date.
• Storage limitation: Personal data should not be kept longer than necessary.
• Integrity and confidentiality: Appropriate security measures to protect personal data should be implemented.

GDPR has an extraterritorial scope, meaning that it applies not only to organizations within the EU but also to any organization outside the EU which offers goods and services to EU citizens or monitors and observes their behavior. So, any organization processing the personal data of EU citizens, regardless of its location, is subject to GDPR compliance.

The GDPR is monitored and enforced by data protection authorities in each EU member state. These authorities oversee compliance with the regulation and investigate any reported violations. Non-compliance with GDPR leads to severe penalties, which may include fines of up to 4% of the company’s global annual revenue or 20 million euros (whichever is higher), depending on the nature and severity of the breach. As a result, GDPR significantly impacts how businesses worldwide handle and protect personal data.

Connect with our Security Experts to assess your controls and prove your compliance with GDPR by sharing your assessment profile. Our engagement options are ideal for organizations of all sizes with and without an experienced in-house IT team. Connect with an expert or schedule a consultation to explore the option that is best for your organization.