What we need to know about EU Data Protection Regulation (GDPR)

The EU General Data Protection Regulation (GDPR) has applied since 25 May 2018. It sets rules for the use of personal data. These include accountability, data portability and reporting data breaches.

The rules can also apply to businesses outside the EU. Firms should check which duties apply to their work. Breaches can lead to large fines.

1. Who must follow the rules?

The GDPR covers personal data used in the activities of an EU establishment. It can apply even when the data is processed elsewhere.

A firm outside the EU can also fall within its scope when it offers goods or services to people in the EU. The goods or services do not have to be paid for. Monitoring people's behaviour in the EU can also bring a firm within scope.

Signs of targeting EU customers can include EU languages, currencies and local customer service. These signs must be assessed together. A website being visible in the EU alone is not enough.

A non-EU firm covered by these rules may need an EU representative. Exceptions include public bodies and some occasional, low-risk processing. The exception has conditions, including limits on large-scale use of sensitive data.

2. Principles for using personal data

Organisations must follow these principles:

• Use data lawfully, fairly and openly.
• Collect it for clear, specific and lawful purposes.
• Use only the data needed for those purposes.
• Keep it accurate and correct errors.
• Keep data that identifies people only as long as needed, subject to lawful exceptions.
• Protect it from unauthorised use, loss and damage.

Keep records that show how you meet these duties. Set a data protection policy and train staff who handle personal data. Record the legal basis for each use and keep evidence, such as consent records.

Assess risks and set clear retention periods. A code of conduct or certification can also support your data protection work.

3. Legal grounds for processing

Each use of personal data needs a valid legal basis. The GDPR sets out six grounds:

• The person gives valid consent for a specific purpose.
• The data is needed to fulfil a contract or take steps requested before a contract.
• A legal duty requires the processing.
• The processing protects someone's vital interests.
• It is needed for a public-interest task or an official authority's work.
• It serves a legitimate interest, unless the person's rights override that interest.

4. Consent

Consent must be freely given, specific, informed and clear. Explain what data you use and why, in plain language. Ask people to take a clear action to agree. Silence and pre-ticked boxes do not count.

Separate consent from other terms. Where consent covers several purposes, let people choose each purpose. People must be able to withdraw consent as easily as they gave it. Explain this right before asking them to agree.

For an online service offered directly to a child, parental consent may be needed when consent is the legal basis. The age threshold depends on the EU country and ranges from 13 to 16.

5. People's rights

Access to data

People can ask whether you process their data and request a copy. Explain the purposes, data types and retention periods. The first copy is normally free. A reasonable fee may apply to additional copies or certain excessive requests.

Deleting data

People can request deletion in cases such as these:

• The data is no longer needed for its original purpose.
• The data was processed unlawfully.
• Consent is withdrawn and no other legal basis applies.

The right has exceptions. For example, a legal duty may require you to keep certain records.

Restricting processing

A person may ask you to limit the use of their data. This can apply while you check disputed accuracy or assess an objection. It can also apply when processing is unlawful but the person wants restriction instead of deletion.

Notify recipients of a restriction where required. Exceptions can apply if notification is impossible or involves disproportionate effort.

Moving data to another provider

Data portability lets people obtain data they supplied in a structured, commonly used electronic format. This applies to automated processing based on consent or a contract. They may ask you to send it directly to another provider when technically possible.

6. Privacy by design and by default

Build data protection into a product from the start. Assess the type and amount of data, the purpose, the tools and the risks. Use suitable technical and organisational safeguards. Pseudonymisation can be one of these safeguards.

Default settings should limit data collection, use, access and retention to what the purpose needs. Data should not be open to an unlimited audience by default. For example, a service can let users choose who may see their photos.

7. Assessing risks

Where processing is likely to create a high risk to people's rights, a data protection impact assessment is needed. It should cover:

• The planned processing and its purpose.
• Whether the use of data is necessary and proportionate.
• The risks to people's rights and freedoms.
• Safeguards that reduce those risks and support compliance.

8. Data Protection Officer

A Data Protection Officer (DPO) advises an organisation and checks how it meets its data protection duties. Appointment is required in certain cases. These include public bodies, subject to exceptions, and core activities that involve large-scale, regular monitoring. Large-scale use of special-category or criminal-offence data can also require a DPO. National law may set further requirements.

The DPO's tasks include advising staff, monitoring compliance and helping with risk assessments. The DPO also works with the supervisory authority and acts as a contact for data protection questions.

A group of companies may share a DPO if the officer is easy to reach from each establishment. Publish the officer's contact details. The DPO must act independently and report to senior management.

The organisation remains responsible for compliance. Appointing a DPO does not transfer that responsibility to the officer.

9. Fines

The GDPR has two main maximum fine levels. Certain breaches can lead to fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher. More serious breaches can lead to up to €20 million or 4%, whichever is higher.

The lower level covers duties such as some security, breach-reporting and privacy-by-design requirements. The higher level covers matters such as basic processing principles, consent, people's rights and international transfers.

These are maximum limits, not automatic fines. Authorities assess the facts and severity of each case.