What it covers. The General Data Protection Regulation, Regulation (EU) 2016/679, applies from May 2018 and governs the processing of personal data of individuals in the European Union. It sets principles for processing, lawful bases, rights for individuals, obligations for controllers and processors including security and breach notification, rules on international transfers, and the powers of supervisory authorities, including fines.
In practice. Organisations build a privacy programme around accountability: records of processing, lawful bases, notices, rights request handling, vendor management, DPIAs, security measures and breach procedures, with a data protection officer where required. Evidence is the documentation behind each of these, kept current and linked to actual systems. Security teams contribute mainly through Article 32 measures and breach response.
Common gaps. Programmes often start strongly and then drift as systems change. Documentation that does not match reality is a frequent weakness when an authority investigates.