GDPR

The EU's data protection law.

It sets rules for how organizations collect, use, store, and share personal data about people in the European Union, and it gives those people rights over their data.

Regulation (EU) 2016/679, requiring a valid legal justification, such as consent or a contract, before personal data can be processed, plus rules on minimizing what's collected and giving people rights like access and deletion. The General Data Protection Regulation (GDPR) has applied since May 25, 2018.

The regulation rests on several principles:

• Lawfulness, fairness, and transparency, meaning a valid legal basis and clear information for the person.
• Purpose limitation, meaning data is collected for a stated purpose and not reused freely for others.
• Data minimization, meaning only what is necessary is collected.
• Storage limitation, meaning data is kept no longer than needed.
• Security and accountability, meaning organizations protect data and can show how they comply.

People get specific rights, including the right to access their data, correct it, and ask for its deletion, known as the right to erasure.

The law has wide reach. It applies to organizations in the EU and also to organizations elsewhere that offer goods or services to people in the EU or monitor their behavior.

GDPR sits next to terms that are easy to mix up:

• Consent is one of several legal bases for processing, and it is often the route for sensitive data such as biometrics.
• PII (personally identifiable information) is the common US term, while GDPR uses the broader term personal data.
• CCPA/CPRA is California's consumer privacy law, which resembles GDPR in some respects and differs in others.

For more, see the Privacy Hub.