Definition
💡 The General Data Protection Regulation (GDPR) is a data privacy and security law. Passed in 2018 by the EU, the GDPR replaced decades-old data protection rules.
Who does GDPR apply to?
The GDPR applies to all organizations within and outside of the European Union, specifically those that handle or use the personal information of EU citizens. For example, if you are a US-based business that offers services to EU citizens and collects their information, then you’re subject to the GDPR. Furthermore, if you monitor the behavior of EU citizens using cookies, then this law applies to your business as well.
Non-compliance will subject businesses of all sizes to heavy fines. The amount will depend on 10 factors, including the gravity and nature of the infringement and the data category affected by the infringement. Penalties have two tiers:
- Less severe infringements could warrant fines of up to €10 million, or 2% of the firm’s annual revenue, whichever is higher.
- More severe violations can rack up fines of up to €20 million, or 4% of the annual revenue, whichever is higher.
Note that the GDPR doesn’t apply to individuals (natural persons), as long as they’re conducting a strictly “personal or household activity” like social networking.
How to be GDPR-compliant
At the GDPR’s core is personal information, such as the person’s name and IP address, and how it’s used by businesses and organizations. However, complying with GDPR requirements can be a huge challenge for organizations.
To ensure compliance, you can refer to this checklist for data controllers. There are also some steps you can take to improve your email sending/data handling practices, such as:
- Knowing the types of information you have and how they’re processed
- Auditing your data processing operations
- Updating your user consent forms
- Assigning a Data Protection Officer (DPO)
- Implementing measures for data protection and security
To ensure that your website is GDPR-compliant, you must:
- Ask for consent when tracking customers online
- Ensure that customer information is protected using measures like end-to-end encryption
- Give users access to their data when they request it (saved data)
- Perform penetration testing
- Ensure that you have a clear privacy policy that informs users about how and why you collect or use their data
What does GDPR aim to protect?
Known as the world’s strongest privacy and security law, the GDPR protects individual rights and freedoms by keeping personal data safe.
