EU GDPR — General Data Protection Regulation
- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeRegulationLegal InstrumentRegulationSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionEuropean UnionRegion DetailEuropean UnionPublisherEuropean Parliament and Council of the European Union
- VersioningVersionRegulation (EU) 2016/679Effective DateMay 25, 2018 (entered into force May 24, 2016)Issue DateApril 27, 2016 (adopted); published May 4, 2016
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Regulation is EU law published in the Official Journal and is included with the platform for reference.
Framework text is licensed by its publisher and is included only where stated above.
- The GDPR (Regulation (EU) 2016/679) governs the processing of personal data of people in the European Union.
- Adopted April 27, 2016, it has applied since May 25, 2018 and is enforced by national supervisory authorities.
- It sets seven principles, six lawful bases, individual rights, and a duty on controllers to demonstrate compliance.
- Fines reach EUR 20 million or 4 percent of worldwide annual turnover under Article 83.
- Organizations handle rights requests within one month, notify breaches within 72 hours, and control transfers outside the Union.
Overview
The General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) governs the processing of personal data of people in the European Union: it sets seven principles, six lawful bases and a set of individual rights, requires controllers to demonstrate compliance, and allows fines of up to EUR 20 million or 4 percent of worldwide annual turnover. It was adopted on April 27, 2016, entered into force on May 24, 2016 and has applied since May 25, 2018.
The European Parliament and the Council adopted it, and independent national supervisory authorities enforce it, coordinated by the European Data Protection Board. It applies to controllers and processors established in the Union and to those outside it that offer goods or services to people in the Union or monitor their behavior there (Article 3). Member States add national rules where the Regulation leaves choices open.
Organizations implement it by mapping processing, choosing a lawful basis for each purpose, informing people, handling rights requests within one month, securing data, contracting processors, assessing high-risk processing, notifying breaches within 72 hours and controlling transfers outside the Union.
Why does it matter?
The GDPR changed privacy from a notice-and-consent exercise into a demonstrable accountability regime. Controllers must be able to show how each principle is met, and the scale of the fines under Article 83 is tied to worldwide turnover.
Key benefits include:
- Accountability is the test
The controller is responsible for, and must be able to demonstrate, compliance with the principles (Article 5(2)).
- Rights people can use
Access, rectification, erasure, restriction, portability, objection and protection from solely automated decisions (Articles 15 to 22), with a response due within one month (Article 12(3)).
- Breach notification clock
A personal data breach that risks people's rights is notified to the supervisory authority within 72 hours of becoming aware of it (Article 33).
- Controlled transfers
Personal data leaves the Union only on an adequacy decision, appropriate safeguards or a listed derogation (Articles 44 to 49).
- Fines that scale
Infringements of certain provisions carry up to EUR 20 million or 4 percent of worldwide annual turnover, and others up to EUR 10 million or 2 percent (Article 83).
How does it work?
The Regulation has eleven chapters. Chapter II sets principles (Article 5), lawful bases (Article 6), consent (Articles 7 and 8) and special categories (Article 9). Chapter III covers rights. Chapter IV covers controllers and processors, including data protection by design (Article 25), processors (Article 28), records (Article 30), security (Article 32), breach notification (Articles 33 and 34), impact assessments (Articles 35 and 36) and data protection officers (Articles 37 to 39). Chapter V covers transfers, Chapters VI and VII supervision and cooperation, and Chapter VIII remedies and penalties.
An organization starts by mapping what personal data it holds and why, then selects a lawful basis under Article 6 and, for special categories, a condition under Article 9. It issues notices under Articles 13 and 14, puts a rights-request procedure in place, records processing activities where Article 30 requires and sets processor contracts that meet Article 28.
Where processing is likely to be high risk it carries out a data protection impact assessment (Article 35), appoints a data protection officer where Article 37 requires, and, for cross-border processing, deals with a lead supervisory authority under the one-stop-shop mechanism (Articles 56 and 60).
Key Elements
- Principles (Article 5)
Lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.
- Lawful bases (Article 6) and consent (Articles 7 and 8)
Consent, contract, legal obligation, vital interests, public task and legitimate interests. Consent must be freely given, specific, informed and unambiguous, and children's consent has its own age rule.
- Data subject rights (Articles 12 to 22)
Transparent information, access, rectification, erasure, restriction, portability, objection and rights about automated decision making.
- Controller and processor duties (Articles 24 to 43)
Responsibility of the controller, data protection by design and by default, processor contracts, records, security, breach notification, impact assessments and data protection officers.
- International transfers (Articles 44 to 50)
Adequacy decisions, standard contractual clauses and binding corporate rules, and narrow derogations.
- Enforcement (Articles 51 to 84)
Independent supervisory authorities, cooperation and consistency through the European Data Protection Board, the right to compensation (Article 82) and administrative fines (Article 83).
What does it cover?
The GDPR applies to the processing of personal data wholly or partly by automated means, and to non-automated processing that forms part of a filing system (Article 2). It covers controllers and processors established in the Union, and those outside the Union that target or monitor people in it (Article 3). It does not apply to purely personal or household activity, or to areas such as law enforcement processing and national security.
What are its objectives?
The GDPR protects the fundamental rights and freedoms of natural persons in relation to the processing of their personal data and allows the free flow of data in the Union.
Set common principles and lawful bases for processing personal data.
Give individuals enforceable rights and clear information.
Require controllers to demonstrate compliance and to build in data protection.
Require breach notification and impact assessment for high-risk processing.
Provide effective supervision, remedies and penalties across the Union.
Framework in Context
The GDPR is directly applicable in every Member State and sits beside national laws that fill in its open choices, such as the Irish and Swedish data protection acts. It is complemented by the ePrivacy rules for electronic communications and by guidelines of the European Data Protection Board. Organizations often map it to ISO/IEC 27001 and ISO/IEC 27701 for management system controls.
Common Framework Mappings
Organizations map EU GDPR to other privacy and security frameworks to harmonize controls, simplify compliance across jurisdictions, and enable integrated data protection governance and auditability.
Mapped frameworks include:
APEC Privacy Framework
California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)
ISO/IEC 27001
ISO/IEC 27002
ISO/IEC 27701
NIST Privacy Framework
OECD Privacy Guidelines
UK Data Protection Act 2018
How SmartSuite Supports EU GDPR
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Privacy Management to hold the records of processing, lawful bases, rights requests with their one-month deadlines, impact assessments and breach records, and Third Party Risk Management for processor contracts under Article 28.
Records of Processing
Keep a record of each processing activity with purpose, categories, recipients, transfers and retention (Article 30).
Lawful Basis and Consent Register
Record the Article 6 basis, any Article 9 condition and consent evidence for each purpose (Articles 6, 7 and 9).
Rights Request Workflow
Run access, erasure and other requests with the one-month deadline, identity checks and an audit trail (Articles 12 to 22).
Impact Assessment Tracker
Hold DPIAs, risk ratings, mitigation actions and prior consultation records (Articles 35 and 36).
Breach Notification Workflow
Time each breach against the 72-hour rule and record notices to the authority and affected people (Articles 33 and 34).
Processor and Transfer Oversight
Track processor contracts, sub-processors and the transfer mechanism for each flow outside the Union (Articles 28 and 44 to 49).
Related frameworks
The APEC Privacy Framework (2015) sets nine information privacy principles that APEC economies use to protect personal information while keeping data flowing across the region.
The CCPA, as amended by the CPRA, gives California residents rights to know, delete, correct and opt out, and is enforced by the California Privacy Protection Agency.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
Frequently Asked Questions For EU GDPR (General Data Protection Regulation)
Controllers and processors established in the Union, and those outside it that offer goods or services to people in the Union or monitor their behavior there (Article 3). It covers the processing of personal data by automated means and non-automated processing in a filing system (Article 2).
Consent, contract, legal obligation, vital interests, public task and legitimate interests (Article 6(1)). Special categories of data need an additional condition under Article 9.
The controller notifies the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach that is likely to result in a risk to people's rights and freedoms (Article 33). People are told without undue delay when the risk is high (Article 34).
One month from receipt, which can be extended by two further months for complex or numerous requests with notice to the person (Article 12(3)). Information is provided free of charge in principle.
Up to EUR 20 million or 4 percent of total worldwide annual turnover, whichever is higher, for infringements of the principles, data subject rights, transfer rules and orders. Up to EUR 10 million or 2 percent applies to other listed provisions such as controller and processor duties (Article 83(4) to (6)).
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.