Home FAQs GDPR

GDPR — General Data Protection Regulation FAQ

Expert answers on GDPR compliance, data subject rights, consent management, DPO requirements, and breach notification.

Understanding GDPR

The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection law that came into effect on May 25, 2018. It governs how organizations collect, process, store, and transfer personal data of individuals in the EU/EEA.

GDPR applies globally — any organization that processes EU residents' data must comply, regardless of where the organization is based. Non-compliance can result in fines of up to 4% of global annual revenue or 20 million euros, whichever is higher. Learn more about GDPR compliance.

GDPR applies to:

  • Organizations based in the EU/EEA that process personal data
  • Organizations outside the EU that offer goods or services to EU residents
  • Organizations outside the EU that monitor the behavior of EU residents

This means many US, Indian, and global companies must comply if they have EU customers, employees, or website visitors from the EU.

GDPR grants individuals (data subjects) eight fundamental rights:

  • Right of Access: Know what data you hold about them
  • Right to Rectification: Correct inaccurate data
  • Right to Erasure: Request deletion ("right to be forgotten")
  • Right to Restrict Processing: Limit how data is used
  • Right to Data Portability: Receive data in a portable format
  • Right to Object: Object to processing for specific purposes
  • Rights re: Automated Decision-Making: Not be subject to solely automated decisions
  • Right to be Informed: Know how data is being processed

Compliance Requirements

A DPO is mandatory under GDPR if your organization:

  • Is a public authority or body
  • Carries out large-scale systematic monitoring of individuals
  • Processes large-scale special categories of data (health, biometric, genetic data)

Even if not mandatory, appointing a DPO is recommended as good practice. The DPO can be an internal employee or an external service provider.

GDPR penalties are structured in two tiers:

  • Lower tier: Up to 10 million euros or 2% of global annual revenue for violations like failing to maintain records or not reporting breaches
  • Upper tier: Up to 20 million euros or 4% of global annual revenue for violations like unlawful processing, violating consent conditions, or infringing data subject rights

Major fines have been issued to companies like Google (50M euros), Amazon (746M euros), and Meta (1.2B euros). Ensure your compliance now.