GDPR

The General Data Protection Regulation (GDPR) is the toughest privacy and security law in the world. Though it was drafted and passed by the European Union, it imposes obligations onto organizations anywhere that target or collect data related to people in the EU.

JurisdictionEuropean Union
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development
Enforcement actions on record4

Analysis

Key Requirements

The General Data Protection Regulation (GDPR) imposes several key requirements on organizations that process personal data of EU residents:

  • Lawful basis for processing: Organizations must have a valid legal reason for collecting and processing personal data, such as consent, contract fulfillment, or legitimate interests. Article 6 of GDPR
  • Consent: When relying on consent as the legal basis, it must be freely given, specific, informed, and unambiguous. Article 7 of GDPR
  • Data subject rights: Organizations must honor individuals' rights, including access, rectification, erasure, and data portability. Chapter 3 of GDPR
  • Data protection by design and by default: Privacy safeguards must be built into products and services from the earliest stages of development. Article 25 of GDPR
  • Data breach notification: Organizations must report certain types of data breaches to supervisory authorities within 72 hours and to affected individuals without undue delay. Article 33 of GDPR
  • Data Protection Impact Assessments (DPIAs): Organizations must conduct DPIAs for high-risk processing activities. Article 35 of GDPR
  • Data Protection Officer (DPO): Certain organizations must appoint a DPO to oversee GDPR compliance. Article 37 of GDPR
  • Records of processing activities: Organizations must maintain detailed documentation of their data processing activities. Article 30 of GDPR

Compliance Challenges

Organizations face several challenges in achieving and maintaining GDPR compliance:

  • Data mapping and inventory: Many organizations struggle to identify and categorize all personal data they process. According to a Talend survey, 70% of companies couldn't identify all their data subjects.
  • Consent management: Obtaining and managing valid consent can be complex, especially for websites with multiple third-party integrations. A study by MIT, UCL, and Aarhus University found that only 11.8% of consent management platforms met GDPR requirements.
  • Cross-border data transfers: The invalidation of the EU-US Privacy Shield has complicated international data transfers. The Schrems II decision by the European Court of Justice has required organizations to implement additional safeguards.
  • Data subject access requests (DSARs): Responding to DSARs within the required timeframe can be challenging. A Gartner report found that organizations receive an average of 137 DSARs per million identities.

Implementation Best Practices

To implement GDPR effectively, organizations should:

  • Conduct a comprehensive data audit: Map data flows and create a detailed inventory of personal data processing activities. The ICO's documentation guidance provides a helpful framework.
  • Implement a consent management platform: Use tools like OneTrust or Cookiebot to manage cookie consent and preferences.
  • Establish a data protection governance structure: Appoint key roles such as a DPO and data protection champions. The IAPP's DPO guidance offers valuable insights.
  • Develop and maintain policies and procedures: Create comprehensive data protection policies, including breach response plans. The EDPB's guidelines provide authoritative guidance on various GDPR topics.
  • Conduct regular training: Ensure all employees understand GDPR requirements and their responsibilities. The European Commission's SME guidance includes training resources.

Recent Updates

Recent developments in GDPR implementation and enforcement include:

  • Schrems II decision: On July 16, 2020, the EU-US Privacy Shield was invalidated, requiring organizations to reassess their international data transfer mechanisms. The EDPB's recommendations provide guidance on supplementary measures.
  • Brexit implications: The UK GDPR came into effect on January 1, 2021, requiring organizations to comply with both UK and EU regulations in some cases. The ICO's guidance on UK GDPR explains the differences.

Related Regulations

GDPR interacts with several other privacy and data protection regulations:

  • ePrivacy Directive: Also known as the "Cookie Law," it complements GDPR by focusing on electronic communications. The proposed ePrivacy Regulation will eventually replace this directive.

Industry Impact

GDPR has had significant impacts across various industries:

  • Technology: Big tech companies have faced substantial fines and increased scrutiny. A DLA Piper report shows that tech companies have received some of the largest GDPR fines.
  • Financial services: Banks and financial institutions have had to overhaul their data management practices. A Deloitte study examines GDPR's impact on the financial sector.

Sources

Recent developments

  • — New requirements for GDPR-related data protection complaint processes entered into force under the Data (Use and Access) Act 2025, obliging controllers to have structured procedures to acknowledge complaints within 30 days and investigate without undue delay, tightening practical enforcement of data subject rights.[5] (source)
  • — The European Commission’s 2025 Digital Omnibus proposal (still not final as of April 2026) sets out significant GDPR amendments, including redefining when information is “personal data,” raising thresholds for breach notifications, EU‑wide DPIA lists, expanded legitimate interest use of personal data for AI training with an unconditional right to object, and reduced cookie consent for low‑risk purposes, which would materially change compliance strategies if adopted.[2] (source)
  • — Industry commentary on the Digital Omnibus highlights expected impacts such as fewer cookie banners (with consent no longer needed for up to 60% of cookies), clearer rules for AI providers relying on legitimate interest with strong safeguards, and new exceptions for processing sensitive data to detect and correct bias in LLMs, leading businesses to anticipate both reduced consent friction and stricter governance for AI-related GDPR processing.[2] (source)
  • — UK Ofcom and the ICO issued a joint statement on age assurance for online services accessed by children, aligning expectations under the Online Safety Act 2023 and UK data protection law and signalling heightened regulatory focus on age verification and child‑focused GDPR compliance for digital platforms.[4] (source)
  • — The CJEU’s Brillen Rottler judgment (C‑526/24) clarified the GDPR right of access and damages, holding that a first data subject access request may be deemed excessive and abusive where it is made with the intention of artificially creating conditions to obtain compensation, which could curb opportunistic DSAR-based claims.[4][5] (source)
  • — The Italian Data Protection Authority (Garante) adopted a decision on the transfer of banking customers’ personal data from Intesa Sanpaolo to its new digital bank Isybank, later fining Intesa €17.6 million for unlawful profiling of about 2.4 million customers, underscoring strict GDPR scrutiny of intra‑group data transfers and profiling in financial services.[4][5] (source)
  • — The European Data Protection Board launched Coordinated Enforcement Framework (CEF) 2026 on GDPR transparency and information duties, instructing supervisory authorities to conduct aligned checks on how organisations inform data subjects, which is expected to drive harmonised enforcement and updates to transparency practices across industries.[3] (source)
  • — The UK Court of Appeal in DSG Retail Limited v Information Commissioner [2026] EWCA Civ 140 ruled that a controller’s GDPR data security duties apply to all personal data it controls, regardless of whether the data would qualify as personal data in the hands of a third party, reinforcing broad security obligations for organisations.[4] (source)
  • — The EDPB adopted a standardised data breach notification template to harmonise how organisations report GDPR breaches across the EU/EEA, reducing administrative burden while ensuring consistent information for supervisory authorities and prompting companies to adjust incident response workflows.[3] (source)
  • — France’s Conseil d’État clarified the boundary between pseudonymization and anonymization under the GDPR, holding that data which remain re‑identifiable in practice must be treated as personal data unless the re‑identification risk for the provider is genuinely insignificant, tightening industry interpretations of “anonymised” data.[4] (source)

Enforcement actions

DateAuthorityEntityFineSummary
Garante (Italy)Wind Tre1,700,000 EURSecurity failures leading to a personal data breach affecting telecom customers. (source)
Garante (Italy)IQVIA5,000,000 EURUnlawful processing of health data for commercial analytics. (source)
CNIL (France)Free Mobile and Free42,000,000 EURCombined penalty for security failures behind the October 2024 breach exposing 24 million subscriber records including IBANs. (source)
Irish Data Protection CommissionTikTok Technology Limited530,000,000 EUREUR 485M for unlawful transfers of EEA user data to China (Art. 46) and EUR 45M for transparency failures (Art. 13); corrective order to suspend transfers. (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates