The General Data Protection Regulation (GDPR) is the European Union law that governs how organisations collect, use and protect personal data of people in the EU, with fines of up to 4% of global annual turnover.
How the GDPR works
The GDPR, officially Regulation (EU) 2016/679, was adopted in 2016 and has applied since 25 May 2018. It covers any organisation that processes personal data of people in the EU, wherever the organisation is based. Key principles include lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Individuals gain rights to access, correct, delete and port their data and to object to processing.
Why the GDPR matters for cybersecurity
The regulation turns security into a legal obligation:
- Article 32 requires “appropriate technical and organisational measures”, explicitly mentioning encryption and pseudonymisation.
- Article 33 requires notifying the supervisory authority of a personal data breach within 72 hours of becoming aware of it; Article 34 requires informing affected people when the risk is high. Good incident response plans therefore include a legal track.
- Fines reach up to €20 million or 4% of worldwide turnover, whichever is higher.
Enforcement has been substantial: in 2023 Meta received a record €1.2 billion fine from the Irish Data Protection Commission over transfers of user data to the US, and Amazon was fined €746 million in Luxembourg in 2021. Data breaches caused by weak security have also led to penalties, and the GDPR inspired similar laws worldwide, including the UK GDPR and Brazil’s LGPD.
How organisations comply
- Map where personal data is stored and why it is processed.
- Apply privacy by design, access control, encryption and data loss prevention.
- Appoint a Data Protection Officer where required and run data protection impact assessments.
- Prepare and test a breach notification procedure.
