GDPR

Who it applies to

Controllers and processors established in the EU, and organisations outside the EU that offer goods or services to, or monitor the behaviour of, people in the EU.

Key requirements

• A lawful basis for every processing activity, and processing that follows the principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
• Data subject rights: access, rectification, erasure, restriction, portability and objection, including rights around solely automated decisions.
• Data protection by design and by default, with records of processing activities.
• Data Protection Impact Assessments for processing likely to result in a high risk to individuals.
• A Data Protection Officer where the core activities require one (for example large-scale monitoring or special category data).
• Appropriate technical and organisational security measures, and contracts with processors.
• Safeguards such as adequacy decisions or Standard Contractual Clauses for transfers outside the EEA.

Breach and incident notification

The controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to individuals. Affected individuals are told without undue delay when the breach is likely to result in a high risk. Processors notify the controller without undue delay.

Penalties

Administrative fines of up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements; a lower tier of up to EUR 10 million or 2% applies to others.

Go deeper