GDPR

GDPR (General Data Protection Regulation) is an EU regulation in force since 25 May 2018 that harmonises the rules for collecting, storing and processing the personal data of individuals across the entire European Union. Its goal is to give people control over their own data and to place clear protection obligations on organisations.

How GDPR works

GDPR rests on several fundamental principles for processing data: lawfulness, purpose limitation (data is collected for a specific, stated reason), minimisation (only data that is genuinely needed), storage limitation, and integrity and confidentiality. The people whose data is processed are granted a set of rights:

• the right of access — to know what data is being processed,
• the right to rectification and erasure (the "right to be forgotten"),
• the right to data portability to another controller,
• the right to object to processing, for example for marketing.

Breaches carry heavy fines — up to 20 million euros or 4% of a company's annual global turnover.

GDPR in practice

For a website owner, GDPR means concrete duties: publishing a privacy policy, obtaining consent for cookies and marketing tags, securing forms, and reporting serious breaches within 72 hours. Infrastructure security matters greatly here — encrypting traffic, using strong passwords, keeping regular backups and restricting server access are technical measures the regulation directly expects. GDPR does not forbid processing data — it requires that it be done transparently, purposefully and securely.