GDPR

The General Data Protection Regulation (GDPR) is the European Union law on personal data, in force since May 2018 and tied to where people are located, not to where a company sits.

The regulation requires a lawful basis for each processing purpose, and consent is only one of six possible bases. It splits roles into the controller, which decides the purpose, and the processor, which acts on instruction; it grants people rights of access, correction, erasure and portability; it counts online identifiers such as a cookie ID or an IP address as personal data; and it sets a maximum fine of 20 million euro or 4 percent of worldwide annual turnover, whichever is higher. The common misreading is that a tool can make an organisation compliant. Compliance follows from how collection is configured, what is disclosed to users and what agreements are in place, and buying a product does not transfer it. This entry describes the requirements in general terms and is not legal advice.