What is the GDPR, in plain terms?

The General Data Protection Regulation (GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679).), Regulation (EU) 2016/679, is the EU law on handling information about people. It applies directly in every Member State and covers any processing of personal data, meaning information that identifies a person directly or indirectly, by organisations in the EU and by organisations outside it that offer goods or services to people in the EU or monitor their behaviour. Its core ideas are simple: have a lawful reason for each use of data, use only what you need, keep it accurate and no longer than necessary, protect it, be transparent with the people concerned and be able to show all of this. People get rights such as access, correction and erasure. For a security team the GDPR matters twice: security logs are themselves personal data, and a security incident can be a personal data breach with its own notification duty. National laws add rules, for example on employee data, so check yours.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on EU law: GDPR, DORA, CRA and AI ActAll topics