GDPR
GDPR stands for General Data Protection Regulation.
It's a European Union law that gives people strong rights over their personal data, including the right to see what data companies have about them, request its deletion, and object to its use. While it's an EU law, it affects any organization worldwide that handles data from people in Europe, which is why you see cookie consent banners on so many websites.
GDPR, explained at three levels
At home
GDPR is a law that says companies must be careful and honest about how they use your personal information. It gives you the right to ask a company what data they have about you, to have that data deleted, and to say no to certain uses. It's the reason websites ask you to accept or reject cookies when you visit them.
At work
For businesses, GDPR requires a lawful basis for processing personal data, clear privacy notices, prompt breach notification, and respect for individual rights like data access and deletion. Non-compliance can result in significant fines. Any organization handling EU residents' data must comply, regardless of where the company is based.
At home
GDPR is built on key principles: data must be processed lawfully and transparently, collected for specific purposes, minimized to what's necessary, kept accurate, stored only as long as needed, and protected with appropriate security. These principles guide how organizations should design their data handling practices from the start.
At work
Professionally, GDPR compliance involves appointing a Data Protection Officer where required, conducting data protection impact assessments for high-risk processing, maintaining records of processing activities, and implementing technical and organizational security measures. Organizations also need procedures to respond to data subject rights requests within the required 30-day timeframe.
At home
Advanced users leverage GDPR rights by submitting data subject access requests to learn what companies know about them, requesting deletion of data they don't want stored, and opting out of automated decision-making. Understanding these rights gives you practical tools to control your digital footprint across services operating in or targeting the EU.
At work
At an enterprise level, GDPR compliance is an ongoing program involving cross-functional teams across legal, IT, security, and business units. Advanced considerations include cross-border data transfer mechanisms, managing consent across complex data ecosystems, implementing privacy by design in software development, and coordinating with supervisory authorities during investigations or audits.
Real-world examples
At home
Sarah, living in France, used her GDPR rights to request all the data a social media company had collected about her. She was surprised by the volume and used her right to deletion to remove most of it, keeping only what was necessary for her account to function.
At work
Marcus, a product manager at a U.S.-based software company, learned that their app collected data from European users. He led a project to bring the product into GDPR compliance, adding consent mechanisms, building a data deletion pipeline, and documenting all data processing activities.
Common confusions
- It's easy to assume GDPR only applies to European companies. It applies to any organization worldwide that processes data of people in the EU.
- It's often assumed that GDPR is just about cookie banners. It covers all aspects of personal data processing, including collection, storage, sharing, and deletion.
- It's a common myth that GDPR prevents companies from collecting any data. It allows data collection when there's a lawful basis, but requires transparency and gives individuals control.
For analysts
Business analysts should assess GDPR applicability early in any project that involves personal data. Requirements should address lawful basis for processing, consent mechanisms, data subject rights fulfillment, data minimization, and breach notification procedures. Including GDPR considerations in requirements prevents costly redesigns and demonstrates regulatory awareness to stakeholders.
History & origin
GDPR took effect on May 25, 2018, replacing the 1995 Data Protection Directive. It was designed to modernize data protection for the internet age and create consistent rules across the EU. Its impact was global, prompting similar legislation in California (CCPA), Brazil (LGPD), and many other jurisdictions.