General Data Protection Regulation (GDPR)

What it is

Regulation (EU) 2016/679 is the EU's general law on the protection of personal data. It sets the rules for when and how organisations may process information about people, gives individuals enforceable rights over their data, and requires appropriate security and breach notification. It exists to give people in the EU a single, high level of protection and to give organisations one set of rules across the single market.

Who it applies to

• Controllers and processors established in the EU that process personal data, whatever their size or sector
• Organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there
• Public authorities and bodies, with some specific rules (for example a mandatory data protection officer)
• Processors such as cloud, SaaS and outsourcing providers, which have their own direct obligations
• Purely personal or household activity is out of scope, as is processing for law enforcement purposes, which falls under a separate directive

Key points

• Every processing activity needs a lawful basis (Article 6), and special categories such as health data need an additional condition (Article 9)
• The principles in Article 5, including data minimisation, storage limitation and integrity and confidentiality, apply to everything, and the controller must be able to demonstrate compliance
• Article 32 requires security appropriate to the risk, taking into account the state of the art, with examples such as encryption, pseudonymisation, resilience and regular testing
• Personal data breaches must be notified to the supervisory authority within 72 hours of becoming aware unless unlikely to result in a risk, and to affected people without undue delay when the risk is high (Articles 33 and 34)
• Processors must be bound by a contract with the content set out in Article 28, and they need the controller's authorisation to use sub-processors
• A data protection impact assessment is required before processing likely to result in a high risk (Article 35)
• Transfers outside the EU need an adequacy decision or another safeguard such as standard contractual clauses (Chapter V)

Where to start

1. 1Build a record of processing activities that lists what personal data you hold, why, where it sits and who it is shared with
2. 2Map your processors and check that each has an Article 28 compliant contract and that international transfers have a valid mechanism
3. 3Agree a breach response procedure that lets you assess and notify within 72 hours, and rehearse it
4. 4Link your security controls to the risks for personal data so you can show why they are appropriate under Article 32