Extended Slovník

GDPR (General Data Protection Regulation)

GDPR is a comprehensive EU data privacy law that gives individuals control over their personal data and imposes strict obligations on organisations worldwide that collect or process data of EU residents.

The General Data Protection Regulation (GDPR) is a comprehensive legal framework that establishes guidelines for the collection and processing of personal information from individuals residing in the European Union (EU) and European Economic Area (EEA). It represents one of the most significant developments in data privacy regulation worldwide.

What is GDPR and its main purpose?

GDPR is a data protection and privacy law enacted on 25 May 2018. Its primary goals are to:

  • Give individuals greater control over their personal data
  • Simplify the regulatory environment for international businesses
  • Unify data protection regulations across EU member states
  • Establish clear rights for data subjects, including the right to access, rectification, and erasure of personal data

Why is GDPR important for businesses?

GDPR applies to any organisation that processes personal data of EU residents, regardless of where the organisation is located. This means businesses worldwide must comply if they:

  • Offer goods or services to EU residents
  • Monitor the behaviour of EU residents
  • Process personal data on behalf of EU-based organisations

Non-compliance can result in severe penalties, including fines of up to €20 million or 4% of annual global turnover, whichever is higher.

Which data is covered by GDPR?

GDPR protects personal data, which includes any information relating to an identified or identifiable person, such as:

  • Names and email addresses
  • Location data and IP addresses
  • Cookie identifiers and device IDs
  • Health, genetic, and biometric data
  • Racial or ethnic origin, political opinions, and religious beliefs

How to achieve GDPR compliance?

Organisations must implement several key measures:

  • Obtain explicit consent for data processing activities
  • Implement privacy by design in all systems and processes
  • Appoint a Data Protection Officer (DPO) where required
  • Conduct Data Protection Impact Assessments (DPIAs)
  • Maintain records of processing activities
  • Report data breaches within 72 hours

Practical examples

Email marketing consent: A company offering an online service must obtain explicit consent before sending marketing emails. This means pre-ticked boxes are not allowed, and users must have an easy way to opt-out at any time.

Cookie compliance: Websites using cookies must display a cookie banner that allows users to accept, decline, or customise their preferences before any non-essential cookies are loaded. Simply notifying users about cookies is not sufficient.

Key resources

For official guidance, organisations should consult:

← Back to Glossary