What is GDPR (General Data Protection Regulation)?

The GDPR applies extraterritorially: any organization that offers goods or services to people in the EU, or monitors their behavior, is covered regardless of where it is established. A US eCommerce store shipping to Berlin or tracking EU visitors on its website is in scope. The law protects 'personal data' — any information relating to an identified or identifiable person, expressly including online identifiers like IP addresses and cookie IDs.

Its architecture rests on principles (Article 5): lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. Every processing operation needs one of six legal bases under Article 6 — consent, contract, legal obligation, vital interests, public task, or legitimate interests — chosen and documented before processing begins.

Individuals ('data subjects') hold enforceable rights: access, rectification, erasure, restriction, portability, and objection, generally answerable within one month. Organizations carry matching duties: privacy notices (Articles 13-14), data protection by design and by default (Article 25), processor contracts (Article 28), records of processing (Article 30), breach notification to regulators within 72 hours (Article 33), impact assessments for high-risk processing (Article 35), and, for some, a Data Protection Officer.

Enforcement runs through national supervisory authorities with two fine tiers — up to €10 million or 2% of global turnover for operational failures, and up to €20 million or 4% for violations of principles, legal bases, or rights. Cumulative fines have run into the billions of euros, with the largest actions targeting unlawful advertising processing and data transfers.