13 Jul 2026
The General Data Protection Regulation reshaped how organisations worldwide handle personal information. Whether you run a small online shop or manage compliance at a multinational corporation, understanding GDPR is no longer optional. This guide breaks down every major aspect of the regulation, from core principles and individual rights to enforcement trends and practical compliance steps, giving you a clear roadmap for navigating EU data protection in 2025 and beyond.
The General Data Protection Regulation (GDPR) is the core data protection law across the European Union, in force since 25 May 2018. It replaced the 1995 Data Protection Directive and has since become the global benchmark for privacy standards in the digital age.
GDPR protects the personal data of individuals in the EU and EEA. It grants strong data protection rights to every data subject, including the right to access, correct, delete, and port their data. At the same time, it imposes strict obligations and penalties on any organisation that collects or uses such data.
GDPR applies to non-EU businesses that offer goods or services to people in the EU or track their behaviour. Non-EU organizations must appoint an EU representative under GDPR.
Compliance rests on core data protection principles: lawfulness, fairness, transparency, data minimisation, security, and accountability, backed by demonstrable governance and documentation.
GDPR gives individuals control over their personal information, with rights to access, rectify, erase, and object to processing of their data.
The sections below cover practical guidance for individuals, data controllers, processors, and data protection officers, including enforcement developments through 2025.
The GDPR (Regulation (EU) 2016/679) is the EU's main data protection regulation. It governs how organisations collect, use, store, share, and secure personal data. GDPR governs how organizations handle the personal data of individuals in the EU, setting clear legal requirements for every entity that touches such information.
The regulation was adopted by the European Parliament on 27 April 2016. The General Data Protection Regulation (GDPR) took effect on May 25, 2018, becoming directly binding across all EU and EEA member states without requiring separate national transposition.
GDPR sits at the heart of EU data protection legislation. It works alongside the law enforcement directive (Directive (EU) 2016/680), which covers data processing for policing and criminal justice purposes, and Regulation (EU) 2018/1725, which applies to EU institutions. Together, these instruments form the foundation of EU law on privacy.
The regulation turned data protection into a board-level concern worldwide. It has directly influenced data protection laws in the UK (UK GDPR), Brazil (LGPD), multiple U.S. states, and several Asian jurisdictions, creating a ripple effect across global privacy standards.
In practical terms, GDPR applies to everyday activities you might not think twice about. When you buy something from an online retailer, that business collects your name, address, payment details, and IP address, all of which are personal data protected under the regulation. When a social media platform profiles your behaviour for targeted advertising, it must comply with GDPR rules around processing personal data. Even an employer maintaining HR records is carrying out data processing subject to the regulation.
GDPR protects "natural persons" in the EU/EEA. It covers any personal data that can directly or indirectly identify a living individual: names, email addresses, IP addresses, device identifiers, location data, biometric data, and more. GDPR applies regardless of where data processing occurs globally, meaning the location of servers or offices does not determine whether the regulation applies.
The regulation applies to both controllers and processors established in the EU/EEA. Crucially, GDPR applies to organizations outside the EU if they offer services to EU residents, and it applies to non-EU organizations processing EU citizens' data through tracking, profiling, or selling goods and services. Non-EU organizations must appoint an EU representative under GDPR to serve as a local point of contact.
Typical in-scope organisations include:
Public sector: government agencies, hospitals, schools, regulatory bodies
SMEs: e-commerce sites, SaaS platforms, recruitment agencies, accounting firms handling EU customer or employee data
Big Tech: cloud service providers, social media platforms, online advertising networks operating across member states
GDPR does not generally apply to truly anonymous data where re-identification is impossible, purely personal or household activities like a private address book, or law enforcement processing covered by the law enforcement directive.
Understanding three core roles is essential for anyone working with GDPR.
A data subject is the individual whose personal data is processed. Every resident or visitor in the EU/EEA can be a data subject, whether they are customers, employees, patients, or students. EU citizens and non-citizens alike qualify when their data is processed in an EU context.
A data controller is the organisation or public authority that decides why and how personal data is processed. Data controllers decide how personal data is processed, whether that means an employer determining what employee information to collect or an online retailer choosing which customer details to store. The controller carries primary accountability for compliance.
A data processor is the organisation that handles personal data on behalf of a data controller. Data processors handle personal data on behalf of data controllers, performing specific processing operations under the controller's instructions. Common examples include cloud hosting providers, payroll companies, and marketing automation platforms.
Here is a practical scenario: an Irish clothing retailer sends email marketing campaigns through a U.S.-based email service. The retailer is the data controller because it determines who receives emails, what content is sent, and when campaigns run. The email service is the data processor because it executes the sending on the retailer's behalf. If the processor mishandles data, both parties may face liability depending on their respective failures, but the controller retains overall accountability for ensuring GDPR compliance.
Article 5 of the GDPR establishes seven data protection principles that apply to every processing activity. These principles are the foundation on which every compliance programme is built, and organisations must embed them into their business processes from day one.
Lawfulness, fairness, and transparency: GDPR requires data processing to be lawful and transparent. Organisations must process data in a transparent manner, explaining to individuals what data is collected, why, and how it will be used.
Purpose limitation: Data must be collected for specified, legitimate purposes only. Information gathered for one specified purpose cannot later be repurposed for something incompatible without additional justification.
Data minimisation: Personal data should be minimized to what is necessary. A contact form that only needs a name and email should not ask for a phone number, home address, and date of birth.
Accuracy: Data must be kept accurate and up to date. If a customer changes their address, records should be corrected promptly.
Storage limitation: Organisations must establish strict data retention policies under GDPR. CCTV footage, for instance, should be retained only for the period justified by law or reasonable business necessity, then securely deleted.
Integrity and confidentiality: Appropriate technical and organizational measures must protect data against unauthorised access, loss, or destruction. This includes encryption, access controls, and staff training.
Accountability: Controllers must be able to demonstrate compliance through documentation. GDPR mandates maintaining documentation to demonstrate compliance, including records of processing activities, impact assessments, policies, and audit trails.
These principles connect directly to data protection by design and default (Article 25), which requires privacy to be integrated into systems and processes from the earliest planning stage. Data controllers must implement data protection by design and by default, ensuring that default settings favour privacy and that only necessary data is collected.
Under Article 6, every processing activity must rest on at least one lawful basis. Organisations must have a valid legal basis for processing personal data under GDPR, and choosing the right one affects which rights data subjects can exercise.
Consent: Freely given, specific, informed consent is appropriate for optional activities like marketing emails. Consent must be unambiguous with no pre-ticked boxes. Informed consent means the individual clearly understands what they are agreeing to. Invalid consent has led to significant enforcement actions across Europe.
Contract: Processing necessary to fulfil a contract with the data subject, such as delivering an online order or processing payroll for an employee.
Legal obligation: Processing required by law, for example maintaining tax records or filing employment registrations. This legal obligation basis removes the need for consent when the law itself mandates the processing.
Vital interests: Processing necessary to protect someone's life, typically in medical emergencies where the individual cannot give consent.
Public task: Processing carried out in the public interest or under official authority, such as a regulatory body performing its statutory functions or a task carried out by a government department.
Legitimate interest: Where the controller's legitimate interest is balanced against the individual's rights and freedoms. Common for B2B communications and fraud prevention, but requires a documented balancing test and gives individuals the right to object.
Organisations should document their chosen lawful basis in a record of processing activities and communicate it clearly in privacy notices. GDPR sets clear legal requirements for organizations processing personal data, and getting the legal basis wrong can trigger enforcement action.
Article 9 defines special categories of personal data that receive heightened protection. These include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data about sex life or sexual orientation.
Processing such sensitive data is prohibited unless a specific condition applies:
Explicit consent from the data subject
Obligations under employment or social security law
Substantial public interest grounds established by EU or national law
Medical diagnosis, healthcare provision, or public health purposes
Scientific or historical research with appropriate safeguards
Data about criminal convictions and offences falls under Article 10 and is tightly regulated. Processing such data typically requires control by an official authority or a specific legal mandate under EU or national law.
Practical examples help illustrate these rules. A hospital processing patient medical records must rely on explicit consent or a healthcare legal mandate, implementing strict access controls so only authorised staff can view such data. An employer handling employee medical certificates for sick leave must limit access and retention under national employment law. A company deploying biometric data systems for building access, such as fingerprint or facial recognition scanners, engages in large scale processing of special category data and will likely need a data protection impact assessment before proceeding.
GDPR strengthens data protection rights by giving individuals meaningful control over their personal information. These rights apply regardless of whether the processing organisation is a multinational corporation or a local business.
Right to be informed: Individuals have the right to clear privacy notices explaining who processes their data, why, for how long, and with whom it is shared.
Right of access: Data subjects have the right to access their personal data. Individuals have the right to access their personal data held by any controller, for example by submitting a Subject Access Request to see what records a bank holds about them.
Right to rectification: Data subjects can request rectification of inaccurate data or completion of incomplete records.
Right to erasure: Individuals can request erasure of their personal data under certain conditions, such as when data is no longer needed, consent has been withdrawn, or processing was unlawful.
Right to restrict processing: Individuals can ask a controller to limit certain uses of their data, for instance while a dispute about accuracy is resolved.
Right to data portability: Data subjects have the right to data portability, meaning they can receive their data in a machine-readable format and transfer it to another controller when processing is based on consent or contract.
Right to object: Individuals can object to processing of their personal data for marketing or other purposes based on legitimate interests. Controllers must stop processing unless they demonstrate compelling grounds.
Rights related to automated decision making and profiling: When automated decision making produces legal or similarly significant effects, individuals can request human intervention, express their view, and contest the decision.
Controllers must respond to rights requests within one month, with a possible extension of two further months for complex cases. If a response is inadequate or missing, individuals can complain to their national supervisory authority or pursue judicial remedies.
Under Articles 12 through 14, controllers must inform data subjects clearly about who is processing their data, why, on what lawful basis, for how long, and with whom it will be shared. GDPR mandates transparency in data processing and requires clear privacy notices that individuals can actually understand.
A compliant privacy notice should include:
Identity and contact details of the controller
Contact information for the data protection officer, if one is appointed
Purposes of processing and the lawful basis relied upon
Categories of recipients who will receive the data
Details of any transfers to third countries or international organisations
Retention periods or criteria for determining them
A full list of data protection rights and how to exercise them
The right to lodge a complaint with the relevant data protection authority
For websites, layered notices work well: a concise summary visible on the page with links to the full policy. Just-in-time notices, such as a brief explanation appearing when a user submits a form, supplement this. For offline contexts, a paper form collecting customer data should include the same required elements in a clear and plain language format, particularly where a child's data is involved. Privacy information directed at children must be written so that minors can genuinely understand it.
Appointment of a data protection officer is mandatory under Article 37 in three situations: when the processing organisation is a public authority, when core activities involve large scale processing that requires regular and systematic monitoring of individuals, or when core activities involve large scale processing of special categories of data.
Core tasks of a DPO include:
Advising the organisation on obligations under GDPR and national data protection laws
Monitoring compliance with data protection rules, including staff training and internal audits
Conducting or overseeing data protection impact assessment processes
Serving as the primary contact for the supervisory authority and for data subjects seeking further information
Cooperating with the data protection authority during investigations or consultations
A data protection officer must be independent, possess expert knowledge of data protection regulation GDPR, and cannot be penalised or dismissed for performing their duties. They should report directly to the highest level of management, such as the CEO or board of directors.
Organisations that typically require a DPO include EU government ministries, major hospital systems, and large online platforms that profile users across multiple member states. These entities must publish the DPO's contact details and make them available to both data subjects and regulators.
GDPR requires organizations to implement robust security measures to protect data against unauthorised access, accidental loss, or destruction. These organizational measures and technical safeguards include encryption, pseudonymisation, access controls, intrusion detection systems, regular security testing, and ongoing staff training. The specific measures should be proportionate to the risk involved in the processing operations.
When things go wrong, GDPR's data breach notification rules are strict. Data controllers must report breaches within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. If the breach poses a high risk, affected data subjects must also be informed without undue delay.
Breach notification to the supervisory authority must describe the nature of the breach, categories of data and data subjects affected, likely consequences, and measures taken or proposed.
Here are three realistic breach scenarios and expected responses:
Lost unencrypted laptop: A staff member loses a laptop containing unencrypted customer records. The organisation must contain the incident, assess what data was exposed, notify the supervisory authority within 72 hours, and inform affected individuals if the risk is high.
Compromised marketing database: A cyberattack exposes email addresses, names, and purchase histories. The organisation must isolate affected systems, assess scope, notify the authority, and communicate with customers about protective steps they can take.
Mis-sent email with sensitive data: An employee accidentally sends a spreadsheet containing employee health information to the wrong recipient. The organisation must retrieve the email if possible, document the incident, and assess whether notification is required based on the sensitivity of such data.
Chapter V of the GDPR governs transfers of personal data to third countries and international organisations. Data transfers outside the EU require adequate safeguards under GDPR, and organisations cannot simply move data across borders without ensuring equivalent protection.
Key transfer mechanisms include:
Adequacy decisions: The European Commission can determine that a third country provides an adequate level of data protection. The EU-U.S. Data Privacy Framework, adopted in July 2023, allows data flows to certified U.S. entities. Other countries with adequacy status include Japan, Canada (commercial organisations), South Korea, the UK, and New Zealand.
Standard contractual clauses (SCCs): Pre-approved contractual templates that impose GDPR-equivalent obligations on the data importer. These are the most commonly used mechanism, particularly by SMEs transferring data to non-EU cloud providers.
Binding Corporate Rules (BCRs): Internal policies approved by supervisory authorities for multinational corporate groups transferring data between their own entities.
Derogations: Limited exceptions for specific situations, such as explicit consent or transfers necessary for performing a contract.
The CJEU's Schrems I and Schrems II judgments had a profound impact. Schrems I invalidated the Safe Harbor framework in 2015, and Schrems II struck down the Privacy Shield in 2020, finding that U.S. surveillance laws did not provide sufficient protection for EU personal data. These rulings drove stricter risk assessments and prompted the adoption of updated SCCs and eventually the new Data Privacy Framework.
Enforcement focus on international transfers has intensified between 2022 and 2025, with regulators scrutinising data security arrangements in third countries and imposing substantial fines where safeguards fell short.
Every EU/EEA country has an independent supervisory authority responsible for monitoring and enforcing data protection law in its jurisdiction. These data protection authorities handle complaints, conduct investigations, issue guidance, and impose sanctions.
The Data Protection Commission monitors GDPR compliance in Ireland and serves as the lead data protection authority for many multinational technology companies headquartered there, including Meta, Google, Apple, and TikTok. The data protection commissioner oversees enforcement actions that often have EU-wide implications due to the one-stop-shop mechanism.
The European Data Protection Board (EDPB) ensures consistent application of GDPR across all member states. Its responsibilities include issuing guidelines on emerging topics, resolving cross-border disputes through the consistency mechanism, and publishing opinions on adequacy decisions. In its 2025 annual report, the EDPB reported 414 cross-border cases, 1,299 one-stop-shop procedures triggered, and over €1.15 billion in GDPR fines issued by national authorities in that year alone.
Individuals and organisations can contact their national data protection authority through official websites, dedicated email addresses, or telephone lines. Most authorities publish complaint forms, guidance documents, and FAQs tailored to both individuals seeking to exercise their rights and organisations working toward compliance.
GDPR establishes a two-tier fine system. Less serious infringements can attract penalties up to €10 million or 2% of global annual turnover. The most serious violations carry fines up to €20 million or 4% of revenue, whichever is higher. Data subjects can also seek compensation for material and non-material damage caused by GDPR violations.
Fines for non-compliance can reach €20 million or 4% of revenue, and GDPR violations can lead to fines exceeding €1 billion, as demonstrated in 2021 when Amazon received a €746 million penalty from Luxembourg's CNPD for behavioural advertising without valid consent.
High-profile enforcement actions between 2018 and 2025 include:
Meta (2023): The Irish DPC imposed a fine of approximately €1.2 billion for unlawfully transferring EU user data to the U.S. without adequate safeguards, the largest GDPR fine at the time.
LinkedIn (2024): Received a €310 million fine from the Irish DPC for lawfulness, fairness, and transparency failures in its behavioural advertising practices.
Enforcement is not limited to Big Tech. Regulators have fined SMEs, public bodies, and charities for insecure email practices, excessive CCTV deployment, and failure to respond to Subject Access Requests. Since GDPR's enforcement began in May 2018, more than €5.65 billion in total fines have been imposed across EU data protection authorities through early 2025.
Individuals who believe their rights have been breached can lodge complaints with their national supervisory authority and, in some cases, bring court actions for damages.
While GDPR is directly applicable EU law, member states can and do adopt national data protection legislation to address specific sectors, fill gaps, and implement the regulation's built-in flexibilities.
Ireland's Data Protection Act 2018 supplements GDPR by establishing the Data Protection Commission, setting rules for areas like freedom of information, children's data, and journalism exemptions, and defining how the regulation interacts with existing Irish legislation.
Other examples of national overlay include:
Germany: The Federal Data Protection Act (BDSG) adds detailed provisions on employee data, video surveillance, and the role of the national data protection authority alongside state-level authorities.
France: The Loi Informatique et Libertés, updated to align with GDPR, includes specific rules on health data research, national security exemptions, and CNIL's enforcement powers.
Multinational data organisations must consider both GDPR and relevant national variations when designing compliance programmes. This is particularly important for HR processing, CCTV surveillance policies, and journalism exemptions, where national law may provide additional conditions or derogations that differ from one EU member state to another.
Children receive special protection under GDPR because of their vulnerability and limited understanding of data protection risks, especially in online environments. The regulation recognises that children deserve additional safeguards when their personal data is collected or used.
Key rules for processing a child's data in online services include:
For "information society services" offered directly to children, parental consent may be required for processing. Member states have set varying age thresholds, typically between 13 and 16, below which parental verification is mandatory.
Privacy notices directed at children must use clear and plain language, potentially supplemented with icons or visual aids, so that minors can genuinely understand what is happening with their data.
Default privacy settings should be set to the highest level for younger users, and behavioural advertising and profiling of minors should be restricted or avoided entirely.
Consider a social media platform aimed at teenagers. Under GDPR, it must verify age, obtain parental consent where the child is below the applicable national threshold, avoid profiling minors for ad targeting, and present privacy information in language a young person can understand. Similarly, an educational app collecting student data should default to minimal data collection and avoid sharing information with third-party advertisers.
Article 25 requires data protection by design and by default. Privacy must be embedded into products, services, and business processes from the earliest planning stages, not bolted on as an afterthought. Data controllers must implement data protection by design and by default across all processing activities.
A data protection impact assessment (DPIA) is required when processing is likely to result in a high risk to individuals' rights and freedoms. Typical triggers include:
Large scale processing of special categories of data
Systematic monitoring of publicly accessible areas (e.g. CCTV networks)
Large-scale profiling with significant effects on individuals
Processing involving new technologies or novel combinations of data
A DPIA should cover:
A clear description of the processing operations and their purposes
An assessment of necessity and proportionality relative to the specified purpose
An evaluation of risks to data subjects' rights and freedoms
Measures planned to address and mitigate those risks
For example, before deploying a new mobile app that collects location data and health information, an organisation should complete a DPIA documenting what data is collected, why it is necessary, what risks users face (e.g. data leaks, unauthorised access), and what controls will be implemented (encryption, access restrictions, retention limits).
Ongoing governance measures are equally important. These include maintaining records of processing activities (RoPAs), conducting regular training for staff who process data, performing internal audits, and managing vendor contracts to ensure processors meet their data protection obligations.
GDPR has reshaped how businesses operate across every sector. Compliance costs have increased, particularly for SMEs without dedicated legal or compliance teams, but the regulation has also driven measurable improvements in data security and consumer trust.
GDPR interacts with the wider EU Digital Single Market strategy. Related frameworks include:
The NIS Directive and its successor NIS2, focusing on network and information security
ePrivacy rules governing electronic communications and cookies (still under revision)
The Digital Services Act (DSA) and Digital Markets Act (DMA), which add platform regulation obligations
Practical adaptations since 2018 include cookie consent banners, consent management platforms, privacy dashboards giving users granular control, and increased use of pseudonymisation and anonymisation techniques.
GDPR's influence extends far beyond Europe. The "Brussels effect" describes how the regulation has become a global benchmark, shaping privacy laws in the UK (UK GDPR), California (CCPA/CPRA), Brazil (LGPD), and numerous other jurisdictions. Businesses worldwide now design their privacy practices to meet GDPR standards, recognising that compliance opens doors to the EU market.
Ongoing EU policy discussions build on GDPR's data protection principles. Updates to ePrivacy rules, the EU AI Act, and frameworks for cross-border data flows all reference GDPR as their foundation. Regulators are actively interpreting how the regulation applies to artificial intelligence, biometric surveillance, and blockchain technologies, with the EDPB publishing new guidelines on pseudonymisation and blockchain in 2025.
Current debates centre on how GDPR handles:
Generative AI systems trained on large datasets containing personal data
Biometric identification in public spaces and its implications for a fundamental right to privacy
Blockchain's immutability and its tension with the right to erasure
National security exemptions and their boundaries under EU law
Organisations should monitor guidance from the EDPB and their national data protection authorities for evolving interpretations. As technology advances and new processing methods emerge, GDPR will continue to be tested and refined through enforcement decisions, court rulings, and regulatory guidance.
This FAQ addresses common practical questions that complement the main sections above. Answers are written in plain English and aimed at both individuals and organisations seeking clarity on everyday GDPR issues.
Yes. GDPR applies regardless of organisation size if personal data of people in the EU/EEA is processed. However, some obligations scale with risk and volume. For example, organisations with fewer than 250 employees may not need to maintain detailed records of processing activities unless their processing involves high-risk data, is not occasional, or includes special categories. Small organisations should still follow all data protection principles, provide clear privacy information, implement proportionate data security controls, and respond to data subject rights requests within one month. Most national data protection authorities publish simplified templates, checklists, and guidance specifically designed to help SMEs and charities achieve proportionate compliance without excessive cost.
GDPR protects any natural person whose personal data is processed within the scope of the regulation, regardless of nationality or citizenship. This means tourists visiting Paris, international students studying in Berlin, or temporary workers employed in Dublin all have the same data protection rights as EU citizens while their data is processed in an EU/EEA context. GDPR applies to data controllers outside the EU if processing EU data, meaning the protection follows the context of the processing rather than the passport of the individual. Once processing falls entirely outside EU/EEA scope, other national data protection laws in the relevant jurisdiction would apply instead.
Individuals can exercise their rights by contacting the data controller directly, typically using a dedicated privacy email address, web form, or postal address listed in the organisation's privacy notice. Requests do not need formal legal language. A simple message explaining who you are, what data or right is involved, and how you would like to be contacted is sufficient. The controller must respond within one month. If the response is unsatisfactory, delayed, or missing entirely, individuals can escalate the matter to their national data protection authority by filing a complaint and providing copies of correspondence and any relevant evidence.
The first steps are to contain the incident, assess what happened and what personal data is affected, and document all facts and decisions as they unfold. The organisation must then determine whether the breach is likely to result in a risk to individuals' rights and freedoms. If risk is likely, data controllers must notify breaches within 72 hours to the supervisory authority. If the risk is high, affected individuals must also be informed without undue delay. After the immediate response, the organisation should review its security controls and procedures, identify root causes, implement improvements to prevent recurrence, and maintain detailed records for accountability and potential regulatory investigations.
No. Consent is only one of six lawful bases available under Article 6, and it is not always the most appropriate. Many routine processing activities rely on other bases: contract (delivering goods a customer ordered), legal obligation (tax compliance), or legitimate interest (fraud prevention). Organisations should select the most suitable lawful basis before processing begins and avoid defaulting to consent when there is a clear imbalance of power, such as in an employer-employee relationship, or when withdrawal of consent would be impractical to honour. If you are unsure which lawful basis an organisation relies on for a specific activity, check their privacy notice or contact them directly to ask.
Disclaimer: This article is intended for general informational and educational purposes only and should not be construed as legal, regulatory, tax, business, or financial advice. While reasonable efforts have been made to ensure that all facts, figures, and data are accurate and valid as of the date of publication, no warranty or guarantee is given as to the ongoing completeness, accuracy, or currency of the information The content is based on information available at the time of publication. Regulations, government policies, market conditions, and service offerings may change over time and vary across jurisdictions and providers. As a result, some information may no longer be current or applicable. Readers should independently verify all information and consult qualified professional advisors before making any financial, legal, or business decisions.
