GDPR

GDPR (General Data Protection Regulation)

​

​​Key objectives

​

• Protect people’s personal data and privacy rights.

• Create one clear set of rules across the EU so data can move freely between countries.

 

Scope

​

  Who it covers

• Any organisation (in the EU or outside) that processes personal data of people in the EU.

• Applies if you offer goods/services to people in the EU or track their behaviour online.

​

  What it covers

• Personal data = any information that can identify a person (name, email, IP address, etc.).

 

Main requirements

​

  Basic rules for handling data

• Be clear and honest about how you use data.

• Only collect what you really need and for a clear reason.

• Keep data accurate and delete it when you no longer need it.

• Keep it secure.

• Be able to prove you follow the rules.

​​

  You need a legal reason to process data, such as:

• The person gave clear consent

• It’s needed for a contract

• It’s required by law

• Other limited reasons (vital interests, public task, legitimate interests)

​

  People’s main rights

• See their data

• Correct it

• Delete it (“right to be forgotten”)

• Move it to another service

• Object to certain uses

​

  Other key duties

• Tell people clearly how you use their data

• Report serious data breaches within 72 hours

• Protect data properly (security measures)

• Appoint a Data Protection Officer in some cases

• Have contracts with companies that process data for you

​

  If you are a business with no establishment (office, branch,   or subsidiary) in the EU, and you process personal data of   people in the EU because you:

​

• Offer goods or services to them (paid or free), or

• Monitor their behaviour (e.g. cookies, analytics, tracking, profiling)

​

  then EU GDPR Article 27 generally requires you to appoint   an EU Representative.

​

​​