Complying with GDPR: An Overview of Requirements

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that was adopted by the European Union (EU) in April 2016. It is designed to strengthen and unify data protection for individuals within the EU, while also giving individuals greater control over their personal data. The GDPR requirements apply to any organisation, regardless of size or location, that processes the personal data of individuals in the EU. This includes organisations that process data for marketing purposes, as well as those that process data for other purposes such as employee data, customer data, and health data. The GDPR requires organisations to be transparent about how they collect, use, store, and delete personal data, and to ensure that all personal data is processed in a secure and lawful manner. It also requires organisations to provide individuals with the right to access, rectify, erase, or restrict the processing of their personal data, as well as the right to data portability. Additionally, organisations must notify individuals of any data breaches that occur, and must obtain consent from individuals before processing their personal data. Finally, the GDPR requires organisations to appoint a data protection officer and to conduct data protection impact assessments prior to processing any personal data.

Our most recent thought leadership