Also known as: General Data Protection Regulation · EU data protection
The GDPR (General Data Protection Regulation) is the European Union's data protection law, which governs how personal data of people in the EU may be collected and processed, and grants individuals rights over their data regardless of where the processing organisation is based.
GDPR requires a lawful basis for every processing activity — consent is only one of six, and often not the most appropriate. It also mandates data minimisation, purpose limitation, security measures, and breach notification within 72 hours of becoming aware.
Individual rights include access, rectification, erasure, portability, and objection to processing. Its extraterritorial scope is what made it globally significant: it applies to any organisation processing the data of people in the EU, which is why its structure has been widely echoed in subsequent legislation elsewhere.
Data Minimization
Data minimisation is the principle that an organisation should collect and retain only the personal data actually necessary for a stated purpose, and no more, for no longer than needed.
Right to Erasure
The right to erasure, commonly called the right to be forgotten, allows individuals to request deletion of their personal data in defined circumstances, such as when it is no longer necessary for the purpose it was collected for or consent has been withdrawn.
Data Subject Rights
Data subject rights are the legal entitlements individuals hold over their personal data, typically including the rights to access, correct, delete, port, and object to the processing of information held about them.
CCPA / CPRA
The CCPA, as amended by the CPRA, is California's consumer privacy law, granting residents rights to know what personal information businesses collect about them, to delete it, to correct it, and to opt out of its sale or sharing.
Data Protection Impact Assessment
A data protection impact assessment (DPIA) is a structured evaluation of the privacy risks a proposed processing activity poses to individuals, together with the measures planned to mitigate them.