What Is the GDPR? A Plain-Language Guide to EU Data Protection Law

The General Data Protection Regulation (GDPR) is the European Union’s comprehensive law on the processing of personal data. It has been enforceable since May 25, 2018, and it applies to any organization, wherever it is based, that offers goods or services to people in the EU or monitors their behavior. The regulation sets out seven principles for handling personal data, six lawful bases for processing it, and a set of rights individuals can exercise against the organizations that hold it. Organizations must secure personal data, report qualifying breaches to a supervisory authority within 72 hours, and rely on a valid mechanism before moving data outside the EU and the European Economic Area (EEA). Fines reach up to €20 million or 4% of worldwide annual revenue, whichever is higher.

For organizations that exchange personal data with customers, partners, and regulators, compliance depends on controlling how that data is sent, shared, and accessed. Kiteworks provides a control plane for secure data exchange that helps organizations apply encryption, access control, and audit logging across email, file sharing, and APIs.

This page provides general information, not legal advice. For guidance on how the GDPR applies to your organization, consult your legal or privacy team.

Key Takeaways

1. Geography Does Not Limit the GDPR

The GDPR follows the individual, not the company’s address. A U.S. organization with no EU office is covered if it offers goods or services to people in the EU or monitors their behavior, for example through website analytics or advertising tracking.

2. Every Use of Personal Data Needs a Lawful Basis

Consent is only one of six lawful bases, and it is often not the best fit. Contract, legal obligation, vital interests, public task, and legitimate interests are the other five. Choosing and documenting the right basis before processing begins is a core accountability requirement.

3. Individuals Hold Enforceable Rights, and the Response Window Is Short

Most data subject requests must be answered within one month. That period can be extended by two further months for complex or numerous requests, but only if the individual is told within the first month.

4. Security and Breach Response Are Explicit Legal Duties

The GDPR requires appropriate technical and organizational measures, and it sets a 72 hour clock for breach reporting. Encryption, access control, and audit logs are the controls regulators most often look for after an incident.

5. International Transfers Need a Valid Mechanism

Personal data can leave the EU and EEA only under an adequacy decision, appropriate safeguards, or a narrow exception. Transfer rules have changed repeatedly through court rulings, so organizations should document their mechanism and a fallback.

What Is the GDPR and Whom Does It Protect?

The GDPR (Regulation (EU) 2016/679) replaced the 1995 Data Protection Directive and gave the EU a single set of data protection rules that apply directly in every member state. It protects the personal data of individuals in the EU and the broader EEA, and it gives those individuals control over how organizations collect, use, share, and store that data.

Member states keep some room to add national rules, which is why organizations often also need to account for laws such as the German Federal Data Protection Act (BDSG) and the French Data Protection Act. Email marketing and cookies are covered separately by the ePrivacy rules, described in our guide to the Privacy and Electronic Communications Regulations.

Who Must Comply With the GDPR?

Article 3 sets the scope. The GDPR applies to organizations established in the EU, and it also applies to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior there. Payment is not required for the first test, so a free app aimed at EU users is covered.

The regulation assigns obligations by role:

• Controllers decide why and how personal data is processed. They carry the primary compliance burden.
• Processors process personal data on a controller’s behalf, such as a cloud provider or payroll service. They must follow documented instructions and meet their own security and record-keeping duties.

U.S. organizations should read our guide for U.S. companies handling EU data for practical steps on scoping and sovereignty.

What Counts as Personal Data Under the GDPR?

Personal data is any information relating to an identified or identifiable person (Article 4). That includes obvious identifiers such as names and email addresses, and less obvious ones such as IP addresses, device identifiers, location data, and online identifiers. Pseudonymized data is still personal data because it can be re-linked to an individual. Our entry on PII and PHI explains how the U.S. concepts differ.

Article 9 adds special categories that receive stronger protection: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data used for identification, health data, and data about sex life or sexual orientation. Processing these categories is prohibited unless a specific condition applies, such as explicit consent.

What Are the Seven GDPR Principles?

Article 5 sets the principles that every processing activity must meet:

1. Lawfulness, fairness, and transparency: process data lawfully and tell people what you are doing.
2. Purpose limitation: collect data for specified purposes and do not use it in incompatible ways.
3. Data minimization: collect only what is adequate, relevant, and necessary. See our guide to data minimization.
4. Accuracy: keep personal data accurate and correct or erase inaccurate data promptly.
5. Storage limitation: keep identifiable data no longer than necessary.
6. Integrity and confidentiality: protect data against unauthorized access, loss, or damage.
7. Accountability: be able to demonstrate compliance with all of the above.

What Are the Six Lawful Bases for Processing?

Article 6 requires at least one lawful basis for each processing purpose:

• Consent: the individual has agreed to the specific purpose.
• Contract: processing is necessary to perform or enter into a contract with the individual.
• Legal obligation: processing is required to comply with the law.
• Vital interests: processing is necessary to protect someone’s life.
• Public task: processing is necessary for a task in the public interest or an official function.
• Legitimate interests: processing is necessary for the organization’s or a third party’s legitimate interests, unless outweighed by the individual’s rights.

What Are the GDPR Consent Requirements?

Valid consent must be freely given, specific, informed, and unambiguous, and it requires a clear affirmative act. Pre-ticked boxes do not count. Individuals must be able to withdraw consent as easily as they gave it, and organizations must be able to prove that consent was obtained (Article 7). For online services offered directly to children, Article 8 sets the age of digital consent at 16 by default, and member states may lower it to no less than 13.

What Rights Do Individuals Have Under the GDPR?

Articles 12 to 22 give individuals the following rights over their personal data:

1. The right to be informed about collection and use of their data.
2. The right of access to their data and to information about how it is processed.
3. The right to rectification of inaccurate or incomplete data.
4. The right to erasure, often called the right to be forgotten, in defined circumstances.
5. The right to restrict processing in certain situations.
6. The right to data portability, which lets individuals receive their data in a structured, commonly used, machine-readable format.
7. The right to object to processing, including direct marketing and processing based on legitimate interests.
8. Rights related to automated decision-making and profiling, including the right not to be subject to solely automated decisions with legal or similarly significant effects.

Individuals also have the right to lodge a complaint with a supervisory authority (Article 77) and to seek compensation for damage (Article 82). Organizations must respond to requests without undue delay and within one month of receipt. Article 12(3) allows an extension of two further months for complex or numerous requests, provided the individual is informed within the first month. Request handling is much easier when audit logs show where personal data is stored and who has accessed it. See our guide to audit logs.

What Does the GDPR Require Organizations to Do?

Beyond the principles and rights, the GDPR sets specific operational duties:

• Data protection by design and by default (Article 25): build privacy controls into systems and limit processing to what each purpose requires.
• Processor contracts (Article 28): use written agreements that bind processors to documented instructions and security measures.
• Records of processing (Article 30): keep a record of processing activities, with limited exemptions for smaller organizations.
• Security of processing (Article 32): apply appropriate technical and organizational measures, which can include encryption, pseudonymization, access control, and regular testing.
• Breach notification (Articles 33 and 34): notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to individuals. Notify affected individuals without undue delay when the risk is high.
• Data protection impact assessments (Article 35): assess high-risk processing before it starts. See our guide to the privacy impact assessment.
• Data protection officer (Articles 37 to 39): appoint a data privacy officer if you are a public authority, or if your core activities involve large-scale regular monitoring or large-scale processing of special categories.

How Do GDPR Rules on International Transfers Work?

Chapter V (Articles 44 to 50) restricts transfers of personal data to countries outside the EU and EEA. A transfer is permitted only through one of these routes:

• An adequacy decision from the European Commission, which finds that a country or framework offers essentially equivalent protection.
• Appropriate safeguards, most commonly Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs), usually combined with a transfer impact assessment.
• A derogation, such as explicit consent for a specific transfer, which regulators interpret narrowly.

The Court of Justice invalidated the EU-U.S. Privacy Shield in 2020 (the Schrems II ruling), which is why organizations should no longer rely on it. Our guides to the transfer impact assessment and cross-border data transfer risks explain how to document a mechanism, and the article on the CLOUD Act and European data protection covers the conflict between U.S. access laws and EU rules. For where data is stored, see GDPR data residency requirements.

How Does the GDPR Affect U.S. Businesses?

Any U.S. business that sells to, markets to, or tracks people in the EU should assume the GDPR applies and should work through a short list of actions:

1. Map where EU personal data enters, moves through, and leaves your systems.
2. Identify a lawful basis for each processing purpose and document it.
3. Update privacy notices, consent flows, and vendor contracts.
4. Set up a process to handle data subject requests within one month.
5. Test your breach response against the 72 hour deadline.
6. Document the transfer mechanism for each flow of EU data to the United States.

Many U.S. organizations also face overlapping state privacy laws. Our guides to the California Privacy Rights Act, the CCPA compliance requirements, and global data privacy laws show where those regimes align with the GDPR and where they differ.

What Are the Penalties for GDPR Noncompliance?

Article 83 sets two tiers of administrative fines:

• Lower tier: up to €10 million or 2% of total worldwide annual revenue, whichever is higher. This tier covers violations such as failing to meet controller and processor obligations, including security and breach notification duties.
• Upper tier: up to €20 million or 4% of total worldwide annual revenue, whichever is higher. This tier covers violations of the basic processing principles, the conditions for consent, data subject rights, and the rules on international transfers.

Regulators weigh the nature, gravity, and duration of the infringement, whether it was intentional, the steps taken to limit harm, and cooperation with the authority (Article 83(2)). They can also order processing to stop, require data to be deleted, or suspend data flows (Article 58). Individuals can claim compensation separately. For recent cases and what they teach, read our analysis of GDPR fines and enforcement trends.

Current Status and Pending Changes

This section is reviewed and updated separately from the rest of the page. Last reviewed: October 2026.

EU-U.S. Data Privacy Framework. The European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework on July 10, 2023. On September 3, 2025, the EU General Court dismissed a challenge to the decision (Latombe v Commission), and the applicant appealed to the Court of Justice on October 31, 2025. The decision remained in effect at the time of this review. Because a reversal is possible, many organizations keep Standard Contractual Clauses available as a fallback.

Digital Omnibus proposal. The European Commission has proposed changes to the GDPR as part of its Digital Omnibus package. In February 2026, the European Data Protection Board and the European Data Protection Supervisor issued a joint opinion. They opposed changes that would narrow the definition of personal data. They partly supported others, including a higher threshold for breach notification and a longer notification deadline of 96 hours. The package was still a proposal at the time of this review, so current obligations, including the 72 hour deadline, remain unchanged.

Enforcement examples. Recent large fines show where regulators focus. The Irish Data Protection Commission fined Meta €1.2 billion in 2023 for transferring EU user data to the United States without adequate safeguards, TikTok €530 million in 2025 for transfers to China, and LinkedIn €310 million in 2024 over its lawful basis for behavioral advertising.

How Kiteworks Helps Organizations Support GDPR Compliance

Most GDPR obligations come down to controlling what happens to personal data once it leaves a system of record. Kiteworks provides a control plane for secure data exchange that governs how personal data is sent, shared, and accessed across email, file sharing, and APIs. The platform helps organizations support GDPR requirements in these ways:

• Customer-owned encryption keys. Customers own their encryption keys, so Kiteworks staff cannot decrypt a customer’s data. See why in our article on customer-owned encryption key control.
• Double encryption. Data is encrypted at the file level and again at the disk level, each with separate keys. Learn more about double encryption.
• Least-privilege access and audit logging. Granular permissions limit who can view or download personal data, and a single audit log records user, data, and system activity. Audit logs are anonymized by default to support privacy requirements. See our guide to the audit log.
• Data sovereignty controls. Geofencing and location settings let organizations keep a user’s data in a designated country and show auditors where it is stored. Explore data sovereignty on the platform.
• GDPR compliance reporting. Built-in reports summarize policy settings, relevant operations, and data checks to support audit preparation.
• Secure web forms. Organizations can collect consent and personal data through secure web forms with customizable notices.

The same controls apply to email, managed file transfer, and SFTP. Explore the Kiteworks data control plane, or read our full set of GDPR compliance resources.

Back to Risk & Compliance Glossary