General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) is the central legal framework governing the protection of personal data in the European Union. It sets out the conditions under which companies and public authorities may process personal data and the rights enjoyed by data subjects. Regulation (EU) 2016/679 has applied directly in all EU Member States since 25 May 2018 and establishes a largely harmonised European data protection framework.

What does the General Data Protection Regulation govern and who does it apply to?

The General Data Protection Regulation protects the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data. At the same time, it ensures the free movement of personal data within the European Union.

Under Articles 2 and 3 GDPR, the Regulation applies in particular to companies, public authorities and other organisations that process personal data by automated means or as part of a structured filing system. Examples include customer data, employee data, contact details and information about website usage.

The Regulation also applies to companies outside the European Union if they offer goods or services to individuals in the EU or monitor their behaviour within the EU. The GDPR therefore also covers international business models.

Exemptions apply in particular to purely personal or household activities. Certain activities carried out by public authorities, such as law enforcement, are also subject to specific data protection rules.

What principles apply under the General Data Protection Regulation?

Article 5 GDPR sets out the fundamental requirements governing the processing of personal data. Companies and organisations must observe these principles in all their processing activities.

The key data protection principles include:

• Lawfulness, fairness and transparency: Personal data may only be processed lawfully and in a manner that is fair and transparent to data subjects.
• Purpose limitation: Data must be collected for specified, explicit and legitimate purposes. Further processing for other purposes is subject to specific conditions.
• Data minimisation: Only personal data that is necessary for the relevant purpose may be processed.
• Accuracy: Personal data must be accurate and, where necessary, kept up to date.
• Storage limitation: As a general rule, personal data must not be stored for longer than is necessary for the relevant purposes.
• Integrity and confidentiality: Personal data must be protected against unauthorised processing, loss and damage through appropriate technical and organisational measures.

The accountability principle under Article 5(2) GDPR also applies. The controller must be able to demonstrate compliance with these principles.

When is the processing of personal data permitted?

Under Article 6(1) GDPR, the processing of personal data is lawful only if at least one of the legal bases listed in that provision applies. Consent is therefore not required for every processing activity.

The GDPR distinguishes in particular between the following legal bases:

• Consent: The data subject has validly consented to the processing of their personal data for a specific purpose.
• Performance of a contract: Processing is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation: Processing is necessary for compliance with a legal obligation.
• Vital interests: Processing is necessary to protect the vital interests of a natural person.
• Public interest or official authority: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• Legitimate interests: Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, provided that these interests are not overridden by the interests or fundamental rights and freedoms of the data subject.

Additional requirements apply to special categories of personal data, such as health data or biometric data used for the purpose of uniquely identifying a person, under Article 9 GDPR.

Companies must identify an appropriate legal basis for each processing activity and comply with the other applicable data protection requirements.

What rights do data subjects have under the GDPR?

The General Data Protection Regulation strengthens the control individuals have over their personal data. Articles 12 to 22 GDPR establish comprehensive rights for data subjects.

The most important rights include:

• Right of access (Article 15 GDPR): Data subjects may request information about whether and which personal data concerning them is being processed.
• Right to rectification (Article 16 GDPR): Inaccurate personal data must be rectified.
• Right to erasure (Article 17 GDPR): Subject to the statutory conditions, data subjects may request the erasure of their personal data.
• Right to restriction of processing (Article 18 GDPR): The processing of personal data must be restricted in certain circumstances.
• Right to data portability (Article 20 GDPR): Under certain conditions, data subjects may receive or have their personal data transmitted in a structured, commonly used and machine-readable format.
• Right to object (Article 21 GDPR): Data subjects may object to processing under the conditions laid down by law.
• Protection in relation to automated decision-making (Article 22 GDPR): The Regulation provides protection against certain decisions based solely on automated processing that produce legal effects or similarly significant effects.

In addition, Article 77 GDPR grants data subjects the right to lodge a complaint with a data protection supervisory authority.

As a general rule, controllers must respond to requests from data subjects within one month. Subject to the conditions set out in Article 12(3) GDPR, this period may be extended by a further two months.

What obligations do companies have under the General Data Protection Regulation?

Companies must integrate the protection of personal data into their organisational and technical processes. The specific obligations depend in particular on the nature and scope of the processing and the associated risks.

The key requirements include:

• Information obligations: Under Articles 13 and 14 GDPR, data subjects must be informed transparently about the processing of their personal data.
• Records of processing activities: Under Article 30 GDPR, controllers and processors must document their processing activities where the statutory conditions apply.
• Technical and organisational measures: Article 32 GDPR requires a level of security appropriate to the risk, for example through access restrictions, encryption and suitable security procedures.
• Processing on behalf of a controller: Where external service providers process personal data on behalf of a controller, the requirements of Article 28 GDPR must be met.
• Data protection officer: Under the conditions set out in Articles 37 to 39 GDPR and supplementary national provisions, companies must appoint a data protection officer.
• Data Protection Impact Assessment: Where processing is likely to result in a high risk to the rights and freedoms of natural persons, a Data Protection Impact Assessment is required under Article 35 GDPR.
• Notification of personal data breaches: Notifiable personal data breaches must generally be reported to the competent supervisory authority within 72 hours of becoming aware of them, pursuant to Article 33 GDPR.

The GDPR also requires data protection to be taken into account during the development of processes and through data protection-friendly default settings. These requirements are set out in Article 25 GDPR.

Specific requirements under Articles 44 et seq. GDPR must also be observed when transferring personal data to countries outside the European Economic Area.

What are the consequences of infringements of the General Data Protection Regulation?

Infringements of the General Data Protection Regulation may result in supervisory measures, claims for compensation and substantial administrative fines.

Depending on the nature of the infringement, Article 83 GDPR provides for administrative fines of up to EUR 10 million or 2%, or up to EUR 20 million or 4% of the total worldwide annual turnover for the preceding financial year. In the case of undertakings, the higher amount applies.

The actual amount of an administrative fine depends, among other things, on the severity and duration of the infringement, the degree of fault and the measures taken to mitigate the damage. Under Article 58 GDPR, data protection supervisory authorities may also order measures such as the adjustment or restriction of unlawful processing operations.

Under Article 82 GDPR, data subjects may also be entitled to compensation for material and non-material damage, subject to the statutory conditions.

Practical example: Implementing the GDPR in an online shop

An online shop processes its customers' names, addresses, email addresses and payment information. The company needs this data to process orders, allocate payments and dispatch goods.

The processing necessary to perform the contract is based on Article 6(1)(b) GDPR. Statutory retention obligations, for example those relating to documents relevant for tax purposes, are based on Article 6(1)(c) GDPR in conjunction with the relevant statutory provisions.

The online shop informs its customers about the processing of their personal data in a privacy notice, establishes appropriate retention periods and protects stored information through suitable technical and organisational measures. It also concludes the necessary agreements under Article 28 GDPR with external processors.

If the company wishes to use customer data additionally for personalised advertising, it must separately assess the applicable data protection and competition law requirements. The legal basis for processing data to perform a contract does not automatically permit every further use of that data.

legal data assessment: The General Data Protection Regulation requires companies to ensure that all processing activities have a lawful basis and that compliance with data protection requirements can be demonstrated. What matters is a data protection-compliant organisational framework that includes clear responsibilities, transparent information, appropriate security measures and comprehensible documentation. Data protection must therefore be permanently integrated into business processes.

Legal bases

The central legal basis is Regulation (EU) 2016/679 (General Data Protection Regulation). Particularly relevant provisions include Articles 1 to 4 GDPR on the subject matter, scope and definitions; Articles 5 and 6 GDPR on the principles of processing and legal bases; Article 9 GDPR on special categories of personal data; and Articles 12 to 22 GDPR on the rights of data subjects.

In addition, Articles 24 to 39 GDPR govern the key obligations of controllers and processors, Articles 44 et seq. GDPR govern international data transfers, and Articles 77 to 84 GDPR address remedies, liability and sanctions.

In Germany, the GDPR is supplemented in particular by the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) and other sector-specific data protection provisions. The GDPR applies directly; national provisions specify or supplement it within the framework of the relevant opening clauses.