What is GDPR? A Complete Guide to EU Data Protection

The General Data Protection Regulation (GDPR) is Regulation (EU) 2016/679 of the European Parliament and of the Council, adopted on 27 April 2016 and enforceable from 25 May 2018. It replaced the 1995 Data Protection Directive (95/46/EC), which had governed data protection across EU member states for over two decades but had become fragmented through inconsistent national implementations and was ill-equipped to address the realities of modern data processing.

GDPR is not a directive — it is a regulation, meaning it applies directly and uniformly across all EU and European Economic Area (EEA) member states without requiring transposition into national law. This distinction is critical: it eliminated the patchwork of 28 different national data protection laws and established a single, comprehensive framework for how organisations collect, store, process, and transfer personal data.

For any organisation that handles the personal data of individuals in the EEA — whether as an employer, a service provider, a retailer, or a technology platform — GDPR compliance is a legal requirement with significant financial and reputational consequences for failure.

Why GDPR was introduced

The 1995 Data Protection Directive was drafted in an era before smartphones, social media, cloud computing, and large-scale algorithmic profiling. By the early 2010s, several factors made reform urgent:

• Technological change. The volume and velocity of personal data processing had grown exponentially. Organisations were collecting behavioural data, location data, and biometric data at a scale the 1995 framework never anticipated.
• Fragmented enforcement. Each EU member state had implemented the Directive differently, creating legal uncertainty for organisations operating across borders and inconsistent protections for individuals.
• High-profile data breaches. A series of major breaches and surveillance revelations — including the Edward Snowden disclosures in 2013 — heightened public awareness of data privacy risks and increased political pressure for stronger protections.
• Regulatory arbitrage. Some organisations deliberately established operations in member states with weaker enforcement, undermining the Directive’s intent.

The European Commission published its initial proposal for reform in January 2012. After four years of negotiation, GDPR was formally adopted in April 2016, with a two-year transition period before enforcement began on 25 May 2018.

Who GDPR applies to

GDPR’s scope is deliberately broad. It applies to two categories of organisation:

Material scope (Article 2)

GDPR applies to the processing of personal data wholly or partly by automated means, and to non-automated processing of personal data that forms part of a filing system. It covers virtually all structured data processing activities performed by organisations, with narrow exceptions for purely personal or household activities, law enforcement processing under the separate Law Enforcement Directive, and processing by EU institutions under their own regulation.

Territorial scope (Article 3)

GDPR applies to:

• Organisations established in the EEA, regardless of whether the actual processing takes place within the EEA.
• Organisations outside the EEA that offer goods or services to individuals in the EEA (whether or not payment is required) or that monitor the behaviour of individuals within the EEA.

This extraterritorial reach is one of GDPR’s most consequential features. A SaaS company headquartered in California, a fintech in Singapore, or a retailer in Brazil must comply with GDPR if it processes data of individuals located in the EEA. Organisations outside the EEA that fall within scope must designate a representative in the EU under Article 27.

Key definitions

Understanding GDPR requires precision with its terminology. The regulation defines several core concepts that underpin every obligation:

Personal data (Article 4(1))

Any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

This definition is intentionally broad. IP addresses, cookie identifiers, device fingerprints, and pseudonymised datasets can all constitute personal data where re-identification is reasonably possible.

Special category data (Article 9)

Certain types of personal data receive heightened protection due to their sensitivity. These include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for identification purposes, health data, and data concerning a person’s sex life or sexual orientation. Processing special category data is prohibited unless one of the specific exceptions in Article 9(2) applies, such as explicit consent or substantial public interest.

Controller (Article 4(7))

The natural or legal person, public authority, agency, or other body that determines the purposes and means of processing personal data. The controller decides why data is collected and how it will be used.

Processor (Article 4(8))

A natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller. Cloud hosting providers, payroll processors, and marketing analytics platforms commonly act as processors.

Data subject

The identified or identifiable natural person to whom personal data relates. GDPR grants data subjects a comprehensive set of rights, including the right of access, rectification, erasure, restriction, data portability, and the right to object to processing.

Supervisory authority (Article 51)

An independent public authority established by each EU member state to monitor the application of GDPR. Examples include the French CNIL, the Irish Data Protection Commission (DPC), and the German Federal Commissioner for Data Protection.

The seven data protection principles

Article 5 of GDPR establishes seven principles that form the foundation of every processing activity. These principles are not aspirational — they are legally binding, and organisations must demonstrate compliance with each of them.

Lawfulness, fairness, and transparency

Personal data must be processed lawfully, fairly, and in a transparent manner. Lawfulness requires that every processing activity relies on one of the six legal bases set out in Article 6: consent, contractual necessity, legal obligation, vital interests, public task, or legitimate interests. Fairness requires that processing does not have unjustified adverse effects on the data subject. Transparency requires that individuals are informed clearly about what data is collected, why, and how it will be used.

Purpose limitation

Personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. An organisation that collects email addresses for order confirmations cannot later use them for unrelated marketing without establishing a separate lawful basis.

Data minimisation

Only personal data that is adequate, relevant, and limited to what is necessary for the stated purposes may be collected and processed. Organisations should not collect data speculatively or retain fields that serve no defined function.

Accuracy

Personal data must be accurate and, where necessary, kept up to date. Organisations must take every reasonable step to ensure that inaccurate data is erased or rectified without delay.

Storage limitation

Personal data must be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which it is processed. This requires organisations to define and enforce retention periods and to delete or anonymise data once those periods expire.

Integrity and confidentiality

Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage. This principle mandates the implementation of technical and organisational measures proportionate to the risk — encryption, access controls, incident response procedures, and regular testing.

Accountability

The controller is responsible for, and must be able to demonstrate, compliance with all of the above principles. Accountability is not merely about being compliant — it is about being able to prove it. This principle underpins requirements for records of processing activities (Article 30), data protection impact assessments (Article 35), data protection officers (Article 37), and data protection by design and by default (Article 25).

Enforcement structure

GDPR enforcement operates through a multi-layered institutional framework designed to ensure consistent application across the EEA while respecting national sovereignty.

National supervisory authorities

Each EEA member state has at least one independent supervisory authority (SA) responsible for monitoring and enforcing GDPR within its jurisdiction. These authorities investigate complaints, conduct audits, issue corrective orders, and impose administrative fines. Notable supervisory authorities include:

• Ireland: Data Protection Commission (DPC) — lead authority for many major technology companies whose European headquarters are in Ireland, including Meta, Google, Apple, Microsoft, and TikTok.
• France: Commission Nationale de l’Informatique et des Libertés (CNIL) — one of Europe’s most active enforcers, particularly on cookie consent and advertising technology.
• Germany: Federal and state-level authorities — Germany’s federal structure means each of its 16 Länder has its own supervisory authority, in addition to the Federal Commissioner for Data Protection.

European Data Protection Board (EDPB)

The EDPB is an independent EU body composed of the heads of each national supervisory authority and the European Data Protection Supervisor. It ensures consistent application of GDPR across the EEA by issuing guidelines, opinions, and binding decisions in cross-border cases. The EDPB replaced the Article 29 Working Party that had operated under the previous Directive.

One-stop-shop mechanism (Article 56)

For organisations with establishments in multiple EEA member states, GDPR provides a one-stop-shop mechanism. The supervisory authority in the member state where the organisation has its main establishment acts as the lead supervisory authority for cross-border processing activities. Other concerned authorities remain involved and can raise objections, but the lead authority coordinates the investigation and decision. This mechanism was designed to prevent organisations from facing parallel investigations in multiple jurisdictions, though in practice it has sometimes been criticised for creating bottlenecks — particularly at the Irish DPC, which oversees many of the world’s largest technology companies.

Penalty structure

GDPR’s penalty framework represented a dramatic escalation from the sanctions available under the previous Directive, where maximum fines in some member states were as low as a few hundred thousand euros.

Two tiers of administrative fines

Tier 1 — up to EUR 10 million or 2% of total worldwide annual turnover (whichever is higher), for infringements relating to:

• Obligations of controllers and processors (Articles 8, 11, 25–39, 42, 43)
• Obligations of certification bodies (Articles 42, 43)
• Obligations of monitoring bodies (Article 41)

Tier 2 — up to EUR 20 million or 4% of total worldwide annual turnover (whichever is higher), for infringements relating to:

• Basic principles for processing, including conditions for consent (Articles 5, 6, 7, 9)
• Data subjects’ rights (Articles 12–22)
• International transfers (Articles 44–49)
• Non-compliance with an order by a supervisory authority (Article 58)

For large multinational corporations, the turnover-based calculation produces fines that can reach into the hundreds of millions or even billions of euros. “Total worldwide annual turnover” refers to the group turnover of the entire undertaking, not just the entity that committed the infringement.

Notable enforcement actions

GDPR enforcement has matured significantly since 2018. Some of the most consequential fines illustrate the regulation’s reach:

• Meta (Ireland, 2023): EUR 1.2 billion — for transferring EU personal data to the United States without adequate safeguards following the invalidation of the EU-US Privacy Shield. This remains the largest GDPR fine issued to date.
• Amazon (Luxembourg, 2021): EUR 746 million — for processing personal data in connection with its advertising targeting system without proper consent.
• Meta/Instagram (Ireland, 2022): EUR 405 million — for processing children’s personal data, including the publication of contact details of minors using business accounts.
• Meta/WhatsApp (Ireland, 2021): EUR 225 million — for failing to meet transparency obligations regarding data sharing between WhatsApp and other Meta companies.
• Google (France, 2022): EUR 150 million — for making it more difficult for users to refuse cookies than to accept them on Google Search and YouTube.

These enforcement actions demonstrate that supervisory authorities are willing to impose fines proportionate to the scale and revenue of the organisations involved, and that no sector or company size is exempt from scrutiny.

GDPR vs other privacy laws

GDPR has influenced data protection legislation worldwide. Several major jurisdictions have enacted their own comprehensive privacy laws, each with similarities to and differences from GDPR.

The key distinction is philosophical: GDPR and LGPD operate on an opt-in model where processing requires an affirmative legal basis, while the CCPA/CPRA framework operates primarily on an opt-out model where data collection is generally permitted but consumers can restrict its use.

Data subject rights under GDPR

GDPR grants individuals a comprehensive set of rights over their personal data. These rights are not absolute — each is subject to specific conditions and exemptions — but organisations must have processes in place to respond to requests within one month (extendable by two further months for complex requests).

• Right of access (Article 15): Individuals can request confirmation of whether their data is being processed, obtain a copy of the data, and receive information about the purposes, categories, recipients, retention periods, and safeguards for international transfers.
• Right to rectification (Article 16): Individuals can request correction of inaccurate personal data or completion of incomplete data.
• Right to erasure (Article 17): Also known as the “right to be forgotten,” individuals can request deletion of their data when it is no longer necessary, when consent is withdrawn, when they object to processing, or when data has been unlawfully processed.
• Right to restriction of processing (Article 18): Individuals can request that processing be limited in specific circumstances, such as while the accuracy of data is being contested.
• Right to data portability (Article 20): Individuals can receive their data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to object (Article 21): Individuals can object to processing based on legitimate interests or public task, including profiling. For direct marketing, the right to object is absolute.
• Rights related to automated decision-making (Article 22): Individuals have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, unless specific conditions are met.

Practical steps toward GDPR compliance

Achieving and maintaining GDPR compliance is an ongoing programme, not a one-time project. Organisations should approach it systematically:

1. Map your data processing activities. Create and maintain a record of processing activities (ROPA) as required under Article 30. Document what personal data you collect, why, where it is stored, who has access, and how long it is retained.

2. Identify and document your legal bases. Every processing activity must rely on one of the six lawful bases in Article 6. Record which basis applies to each activity and, where consent is used, ensure it meets GDPR’s strict requirements for being freely given, specific, informed, and unambiguous.

3. Conduct data protection impact assessments (DPIAs). For processing activities that are likely to result in a high risk to individuals — such as large-scale profiling, systematic monitoring, or processing of special category data — Article 35 requires a formal impact assessment before processing begins.

4. Implement technical and organisational measures. Apply security controls proportionate to the risk: encryption at rest and in transit, access controls and authentication, logging and monitoring, regular vulnerability assessments, and incident response procedures.

5. Establish data subject request procedures. Build internal processes to receive, verify, and respond to data subject requests within the required one-month timeframe. Ensure you can locate and extract all data held about a given individual.

6. Review third-party agreements. Ensure that contracts with processors include the mandatory provisions set out in Article 28, covering the subject matter and duration of processing, the nature and purpose, the type of personal data, and the obligations of the processor.

7. Appoint a Data Protection Officer (DPO) where required. Under Article 37, a DPO is mandatory for public authorities, organisations whose core activities involve large-scale systematic monitoring, and organisations whose core activities involve large-scale processing of special category data.

8. Prepare for data breaches. Under Articles 33 and 34, personal data breaches must be notified to the supervisory authority within 72 hours (where feasible) and, where the breach poses a high risk, to affected individuals without undue delay.

How Prova helps with GDPR compliance

Prova’s GRC platform streamlines GDPR compliance by centralising data mapping, automating evidence collection, and providing real-time visibility into your compliance posture. With pre-built GDPR control frameworks, automated ROPA generation, and integrated risk assessments, Prova reduces the manual effort of maintaining compliance while giving your organisation a defensible audit trail.

Whether you are preparing for your first GDPR compliance programme or managing ongoing obligations across multiple jurisdictions, Prova provides the structure and automation to keep your organisation demonstrably compliant.