# What is the GDPR, in plain terms?

The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, is the EU law on handling information about people. It applies directly in every Member State and covers any processing of personal data, meaning information that identifies a person directly or indirectly, by organisations in the EU and by organisations outside it that offer goods or services to people in the EU or monitor their behaviour. Its core ideas are simple: have a lawful reason for each use of data, use only what you need, keep it accurate and no longer than necessary, protect it, be transparent with the people concerned and be able to show all of this. People get rights such as access, correction and erasure. For a security team the GDPR matters twice: security logs are themselves personal data, and a security incident can be a personal data breach with its own notification duty. National laws add rules, for example on employee data, so check yours.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [EU law: GDPR, DORA, CRA and AI Act](https://netsenx.com/en/faq/eu-law) · https://netsenx.com/en/faq/what-is-the-gdpr-in-plain-terms

## Read next

- https://netsenx.com/en/blog/2026-10-26_ai-act-nis2-dora-cra
- https://netsenx.com/en/compliance
- https://netsenx.com/en/dpa

## Related questions

- [Are IP addresses personal data under the GDPR?](https://netsenx.com/en/faq/are-ip-addresses-personal-data-under-the-gdpr)
- [What counts as a personal data breach under the GDPR?](https://netsenx.com/en/faq/what-counts-as-a-personal-data-breach)
- [What is the difference between a controller and a processor under the GDPR?](https://netsenx.com/en/faq/controller-or-processor-what-is-the-difference)
- [What security measures does the GDPR actually require?](https://netsenx.com/en/faq/what-security-does-the-gdpr-require)
- [Does our company need a data protection officer?](https://netsenx.com/en/faq/do-we-need-a-data-protection-officer)