General Data Protection Regulation: Gdpr Compliance for Businesses

The General Data Protection Regulation (GDPR) is the EU regulation that controls how personal data of individuals in the EU is collected, used, stored, and shared. Personal data means any information relating to an identifiable person, such as names, emails, location data, or online identifiers.

The law applies to controllers, who decide why and how data is processed, and processors, who handle data on a controller's behalf. Both carry obligations. The terms are defined broadly, so most businesses fall into one role or the other.

Yes, GDPR can apply to US businesses even without any office in Europe. Under Article 3, it covers organizations outside the EU that offer goods or services to people in the EU or that monitor their behavior, such as through tracking or profiling.

This extraterritorial scope is what surprises many companies. A US online store shipping to EU customers can be covered. Because GDPR can apply to non-EU companies, cross-border data protection review is often the first step for US businesses that serve EU customers, track EU users, or receive EU personal data.

GDPR is enforced by national supervisory authorities in each EU member state, coordinated through the European Data Protection Board (EDPB). For cross-border processing, a lead supervisory authority often handles the case under a one-stop-shop mechanism.

These regulators investigate complaints, conduct audits, and impose fines. They can also order a company to change or stop its data practices. Knowing which authority is likely to take the lead shapes any compliance or defense strategy.

You are a controller if you decide why and how personal data is processed, a processor if you process it on someone else's behalf, and a joint controller if you make those decisions with another party. The role determines which obligations and contracts apply.

Controllers and processors must usually sign a data processing agreement under Article 28. Non-EU companies within GDPR's scope should also assess whether they must appoint an EU representative under Article 27. Mapping your role early prevents gaps in data governance accountability.

The GDPR principles in Article 5 are lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. Every processing activity also needs a lawful basis under Article 6.

The six lawful bases are consent, contract, legal obligation, vital interests, public task, and legitimate interests. When consent is used, it must be freely given, specific, informed, and unambiguous, and special-category data may require a separate Article 9 condition. The principles define the compliance standard, while the lawful basis explains why a specific activity is permitted.

Data subjects have broad rights over their personal data, exercised through data subject access requests, often called DSARs. Organizations generally must respond within one month, with limited extensions for complex or numerous requests.

Handling DSARs properly is central to consumer data protection, because missed deadlines or improper denials can trigger complaints to supervisory authorities.

You need a data protection officer (DPO) when your core activities involve large-scale, regular monitoring of individuals or large-scale processing of sensitive data, under Articles 37 to 39, and public authorities generally need one too. The DPO oversees compliance and is the contact point for regulators.

Separately, a non-EU company within GDPR's scope may need an EU representative under Article 27. The two roles are different. Use the checklist below to see which compliance duties apply to your business.

A personal data breach must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, under Article 33. If the breach poses a high risk to individuals, Article 34 also requires notifying them.

You must document the breach and your response even if you do not notify. A tested data breach response plan is what makes the 72-hour window realistic. Delay or failure to report can itself become a violation.

GDPR penalties are tiered under Article 83, with the higher tier reaching 20 million euros or 4 percent of total worldwide annual turnover, whichever is greater. Fines can apply to global revenue, not just EU revenue.

Beyond fines, supervisory authorities can order a company to stop processing data, and individuals may seek compensation under Article 82. The combined exposure makes proactive cybersecurity and data privacy planning worthwhile.

US companies can transfer EU personal data only through an approved mechanism, such as standard contractual clauses (SCCs), binding corporate rules, an adequacy decision, or certification under the EU-US Data Privacy Framework. The Data Privacy Framework is a route for participating, certified US companies, not an automatic exemption for every business.

After the Court of Justice's Schrems II decision in 2020 invalidated the prior Privacy Shield, companies relying on SCCs or BCRs should assess the destination country's legal environment, document a transfer impact assessment, and consider supplementary measures where needed. Mapping data flows is the foundation of global data compliance.

Seek GDPR compliance counsel when you are unsure whether GDPR applies, before launching EU-facing services, after a suspected breach, or when you receive a complaint or regulator inquiry. Early advice helps confirm scope, fix gaps, and avoid statements that create exposure.

Bring your data map, processing records, vendor contracts, privacy notices, and any regulator correspondence. Because breach deadlines are short and fines can reach global turnover, acting early is one of the best ways to limit risk.

The General Data Protection Regulation (GDPR) is the EU's data privacy law that controls how organizations handle the personal data of people in the EU. It gives individuals rights over their data and requires businesses to process it lawfully, securely, and transparently, with heavy fines for violations.

Sometimes. A non-EU company that falls within GDPR's scope may need to appoint an EU representative under Article 27 as a local contact point, unless an exemption applies. This is separate from the DPO role, and a business may need to assess both obligations.

A DPO, or data protection officer, oversees an organization's GDPR compliance and serves as the contact for regulators and data subjects. A DPO is required for large-scale monitoring, large-scale processing of sensitive data, and for public authorities, under Articles 37 to 39.

A personal data breach must generally be reported to the supervisory authority within 72 hours of becoming aware of it, under Article 33. If the breach poses a high risk to individuals, they must usually be notified too, and the incident must be documented either way.

The maximum GDPR fine is 20 million euros or 4 percent of total worldwide annual turnover, whichever is higher, under Article 83. A lower tier caps fines at 10 million euros or 2 percent. Regulators can also order a company to stop processing and individuals may seek compensation.