EU GDPR

The EU General Data Protection Regulation (GDPR) is one of the most comprehensive data privacy laws in the world. It came into effect in 2018 and has since become the global gold standard for data protection — inspiring regulations around the world.

The GDPR has extra-territorial scope meaning that it applies also to organisations outside of Europe. If a company does not have an establishment in Europe but targets the EU market or monitors EU data subjects, it falls under the scope of the GDPR. In addition to all other obligations under the GDPR such organisations are required to appoint a representative to act on their behalf as the addressee for authorities and data subjects.

One of the GDPR's core objectives is to give individuals more control over how their personal data is processed. This is reflected in a wide range of data subject rights, including the right to access, rectification, erasure (the "right to be forgotten"), restriction of processing, data portability, and the right to object. Organizations must provide transparent information about data processing and respond to these rights promptly, usually within one month.

The GDPR also imposes strict obligations on organizations to ensure data is processed lawfully, fairly, and securely. Controllers and processors must implement appropriate technical and organizational measures, maintain detailed records of processing activities, and conduct Data Protection Impact Assessments (DPIAs) for high-risk processing. Appointing a Data Protection Officer (DPO) is required in certain cases to ensure ongoing compliance and oversight.

A critical aspect of GDPR compliance is the requirement to report personal data breaches. Organizations must notify the relevant supervisory authority within 72 hours of becoming aware of a breach, unless it’s unlikely to pose a risk to individuals’ rights and freedoms. If the breach is likely to result in high risk, affected data subjects must also be informed. These obligations highlight the GDPR’s focus on accountability, transparency, and the protection of individual privacy.