The General Data Protection Regulation (GDPR) is a broad-sweeping EU privacy law designed to increase an individual’s right to control personal data. Learn about GDPR, whether it applies to you, and how to get started with compliance issues. The GDPR materials presented here are informational only. For specific questions about GDPR compliance, please consult a trained professional.
WHAT IS GDPR?
The General Data Protection Regulation (GDPR) is a European Parliament regulation that came into effect on May 25, 2018. The regulation is designed to harmonise data privacy laws across Europe with the intention to protect and strengthen the privacy rights of EU residents.
COMMON GDPR TERMS
Data controller means the person(s) who determine the purposes and means of processing personal data.
Data exporter means a controller (or, where permitted, a processor) established in the EU that transfers personal data to a data importer.
Data importer means a controller or processor located in a third country that receives personal data from the data exporter.
Data processor means a person or entity that processes personal data on behalf of a controller.
Data subject means an individual who is the subject of the relevant personal data.
Personal data means any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address.
Processing means any operation that is performed on personal data.
Sensitive Data means personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and data concerning health or sex life. Sensitive data are subject to additional protections.
WHAT INFORMATION DOES THE GDPR APPLY TO?
The GDPR applies to personal data and sensitive personal data.
GDPR PRINCIPLES
The GDPR is based on the following privacy and data collection principles and requires that personal data be:
(a) processed lawfully, fairly and in a transparent manner to individuals
from which it is collected;
(b) collected for specified, explicit and legitimate purposes and not further
processed contrary to any of those purposes;
(c) adequate, relevant and limited to what is necessary in relation to the
purposes for which it is processed;
(d) accurate and, where necessary, kept up to date;
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; and
(f) processed in a manner that ensures appropriate security of the personal data.
IMPORTANT NOTE:
The data controller is responsible for, and must be able to demonstrate, compliance with the Data Protection Principles.
