The General Data Protection Regulation is the European regulation that governs the processing of personal data uniformly throughout the EU.
Application and significance
It has applied directly in all Member States since May 2018 and forms the basis for almost all of a company's data protection obligations, from information obligations and data subject rights to breach notification duties.
The GDPR is Regulation (EU) 2016/679. It comprises 99 articles and 173 recitals that assist with its interpretation.
Scope
The GDPR applies to processing in the context of the activities of an establishment in the EU, regardless of where the processing takes place. It covers providers without an establishment in the EU if they offer goods or services to people in the EU or monitor their behaviour (market location principle).
Numerous opening clauses allow supplementary national rules, in Germany above all in the BDSG.
Legal provisions
- Art. 2 GDPR
- Material scope.
- Art. 3 GDPR
- Territorial scope, including the market location principle.
- Art. 5 GDPR
- Principles relating to the processing of personal data.
- Art. 99 GDPR
- Entry into force and application from 25 May 2018.
Related terms.
Personal data Personal data means any information relating to an identified or identifiable natural person. Art. 4(1) GDPR Administrative fine Administrative fines under the GDPR can amount to up to EUR 20 million or 4 per cent of total worldwide annual turnover. Art. 83 GDPR Data protection Data protection is the protection of natural persons with regard to the processing of their personal data. Art. 8 EU Charter of Fundamental Rights 