What the GDPR is
The General Data Protection Regulation, usually shortened to GDPR, is a European Union law on the handling of personal data. It has applied since May 2018 and replaced an older directive with a single set of rules across EU member states. Related versions exist in the European Economic Area, and the United Kingdom retained a closely similar framework after leaving the EU. Many other countries have passed their own laws, some of them influenced by the GDPR.
This article is a general overview, not legal advice. The regulation is long, interpretation develops through guidance and court decisions, and national laws add detail.
Who it covers
The GDPR applies to organizations that process personal data of people in the EU, including businesses outside Europe when they offer goods or services to people there or monitor their behavior. It covers companies, charities and public bodies, with some exceptions, such as purely personal or household activity. The person whose data is processed is called the data subject. The organization deciding why and how data is used is the controller, and a company working on the controller’s behalf is a processor.
Core principles
Organizations are expected to follow a handful of principles. Data should be handled lawfully, fairly and transparently. It should be collected for specific purposes and not used in incompatible ways. Only what is needed should be collected, which is called data minimization. Data should be accurate, kept no longer than necessary, and protected with appropriate security. The controller is also responsible for being able to show that it complies.
Legal bases: consent is not the only one
An organization needs a legal basis to process personal data. The GDPR lists several, including:
- Consent, which must be freely given, specific, informed and unambiguous, and which you can withdraw.
- Contract, where data is needed to provide a service you asked for.
- Legal obligation, such as tax record keeping.
- Legitimate interests, where the organization has a justified interest that is balanced against your rights.
- Vital interests and public tasks, which cover narrower situations.
So a company does not always need your consent. A delivery firm can use your address to deliver an order under the contract basis. Consent is typically required for things like non-essential cookies and some marketing, as covered in the discussion of browser cookies.
Your main rights
Individuals generally have these rights, each with conditions and exceptions:
- Right to be informed. You should be told who is collecting your data, why, for how long, with whom it is shared and how to exercise your rights. This is usually done through a privacy notice, which the article on privacy policies helps you read.
- Right of access. You can ask for confirmation of whether your data is processed and for a copy, along with information about its use.
- Right to rectification. You can ask for inaccurate data to be corrected or incomplete data to be completed.
- Right to erasure. Often called the right to be forgotten. You can ask for deletion in certain circumstances, for example when the data is no longer needed or you withdraw consent. It is not absolute, and organizations may keep data they must retain by law.
- Right to restrict processing. In some situations, you can ask an organization to stop using data while a dispute is resolved.
- Right to data portability. For data you provided that is processed by consent or contract and by automated means, you can ask for it in a structured, commonly used, machine-readable form, and in some cases to have it transferred to another provider.
- Right to object. You can object to processing based on legitimate interests, and you can object to direct marketing at any time.
- Rights about automated decisions. There are protections against decisions made solely by automated means that have legal or similarly significant effects, including in some cases a right to human review.
How to make a request
You usually contact the organization’s data protection contact, whose details are typically in its privacy notice. A short written message stating which right you are using is generally enough, and you may be asked to confirm your identity. Organizations are expected to respond without undue delay and normally within one month, though this can be extended in complex cases. Making a request is generally free, with limited exceptions for requests that are clearly unfounded or excessive.
Keep a copy of what you send and the dates. If your request is ignored or refused without good reason, you can usually complain to your national data protection authority, and you may also have the right to seek a judicial remedy.
Breaches and enforcement
Organizations must report certain personal data breaches to the regulator, typically within 72 hours of becoming aware, and in some cases notify the affected individuals. The topic of what to do afterward is covered under data breaches. Regulators can impose substantial fines for serious violations, with the upper limits set at up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher, for the most serious categories. Actual fines vary widely.
Limits to keep in mind
The GDPR does not stop all data collection, it does not make every request succeed, and it does not apply identically everywhere. Different laws apply outside Europe, such as various state laws in the United States, and their rights may be narrower or work differently. Practical results also depend on the organization, since some respond well and others slowly.
Still, knowing the basics helps. You can ask what a company holds, correct mistakes, stop marketing and, in many cases, have your data removed. Used together with sensible settings and habits, these rights give ordinary users more leverage than they often realize.