In brief
The General Data Protection Regulation (GDPR) is a new European regulation of 99 articles that came into force on 25 May 2018.
The GDPR regulates the processing of personal data of individuals in the European Union. Data processing includes the collection, storage, transfer or use of that data. Under the GDPR, the concept of personal data is broad and covers any information relating to an identified or identifiable individual.
The purpose of the GDPR is to strengthen individuals' rights over their personal data by imposing new responsibilities on companies regarding how they manage and store the data they collect.
Restore individuals' rights over their personal data :
The purpose of the GDPR is to give individuals control over their personal data. The new key concepts are as follows :
the right to be informed : how personal data will be used
the right of access : individuals have the right to access the data a company holds about them
the right to rectification : the right to modify data previously provided to a company
the right to erasure : the right to delete the data a company holds
A key principle: Consent
The GDPR imposes new obligations on companies, notably regarding the requirement to obtain consent for the use of personal data. Companies must be able to justify why they collect specific data. They are also required to be transparent about the retention period for the data and about the measures in place to ensure the security of that data.
Individuals must have control over their personal data. Consent is not final; they can freely change their minds. Therefore, an individual must be able to access the data a company holds about them. They must also be able to delete and modify it.
Who is affected by the GDPR?
The GDPR does not only apply to companies based in the European Union, but to any company that has customers who are residents of the European Union.