General Data Protection Regulation (GDPR): EU personal data law

Key principles and individual rights

The GDPR codifies several foundational principles that organisations must follow when processing personal data. These include lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. The regulation also grants specific rights to individuals, for example:

• Right of access to personal data and information about processing.
• Right to rectification and to erase data ("right to be forgotten").
• Right to restriction of processing and to object to certain kinds of processing, including direct marketing.
• Right to data portability to receive and transfer personal data in a structured, commonly used format.
• Rights concerning automated decision-making and profiling.

Scope, roles and enforcement

The GDPR applies to controllers and processors established in the EU and, in many cases, to organisations outside the EU that offer goods or services to, or monitor the behaviour of, EU residents. Roles defined by the text include data controllers (who determine processing purposes) and data processors (who process on behalf of controllers). Supervisory authorities in each Member State oversee enforcement and cooperate through the European Data Protection Board. Non-compliance can lead to administrative fines of up to €20,000,000 or up to 4% of annual global turnover, whichever is higher, together with other corrective measures.

Practical compliance measures

Organisations subject to the GDPR commonly implement measures such as appointing a Data Protection Officer when required, keeping processing records, carrying out Data Protection Impact Assessments for high-risk activities, and notifying supervisory authorities of personal data breaches within 72 hours when feasible. Cross-border transfers of personal data outside the EU require appropriate safeguards (for example, adequacy decisions, standard contractual clauses or binding corporate rules) and have been influenced by subsequent court rulings and guidance on international data flows.

History, purpose and development

The GDPR was developed to modernise and harmonise data protection rules across the EU in response to technological change and the growth of cross-border digital services. By replacing the 1995 Directive it sought to give individuals stronger control over their personal data while simplifying obligations for businesses operating across multiple Member States. Since its entry into force the GDPR has influenced data protection laws worldwide and prompted updates to corporate practices, software design and public policy.

Impact, examples and notable facts

Practical examples of GDPR application include online platforms updating consent mechanisms, employers limiting access to personnel records, healthcare providers strengthening security for sensitive health data, and marketing teams adapting data collection and profiling practices. The regulation's extraterritorial reach, significant fines, and emphasis on accountability have made it a key reference point for privacy law globally. Its implementation has also prompted legal and policy debates about balancing privacy, innovation and law enforcement needs.

Further reading: See the EU institutions involved in the GDPR's adoption at Parliament, Council and Commission, and overview material on data protection in the EU.