GDPR Compliance Guide: Understanding European Data Protection

The General Data Protection Regulation (GDPR) is the world’s most comprehensive data privacy law, applying to any organization that processes personal data of individuals in the European Economic Area (EEA), regardless of where the organization is located. A US company with a website accessible from Europe and collecting European visitor data is subject to GDPR. Non-compliance carries fines of up to 4 percent of annual global revenue or 20 million euros, whichever is greater. Amazon was fined 746 million euros; Meta received a 1.2 billion euro fine.

Core Principles

Lawfulness, fairness, and transparency. You must have a legal basis for processing personal data (consent, contractual necessity, legitimate interest, legal obligation, vital interest, or public task). Processing must be transparent: individuals must know what data you collect and why.

Purpose limitation. Data collected for one purpose cannot be used for a different, incompatible purpose without new consent.

Data minimization. Collect only the data necessary for the stated purpose. If you do not need a phone number for your service, do not collect it.

Storage limitation. Retain personal data only as long as necessary. Define and enforce retention periods. Delete data when the retention period expires.

Integrity and confidentiality. Implement appropriate technical and organizational security measures to protect personal data against unauthorized access, loss, or destruction.

Individual Rights

Right of access. Individuals can request a copy of all personal data you hold about them. You must respond within 30 days.

Right to rectification. Individuals can request correction of inaccurate personal data.

Right to erasure (right to be forgotten). Individuals can request deletion of their personal data when it is no longer necessary for the original purpose, consent is withdrawn, or processing is unlawful.

Right to data portability. Individuals can request their data in a machine-readable format for transfer to another service.

Right to object. Individuals can object to processing based on legitimate interest, including profiling and direct marketing.

Compliance Steps

Conduct a data mapping exercise to identify all personal data your organization collects, processes, and stores. Establish a legal basis for each processing activity. Implement privacy notices that clearly explain your data practices. Appoint a Data Protection Officer if required (mandatory for public authorities, organizations engaged in large-scale monitoring, or those processing special category data). Implement processes to respond to data subject requests within the 30-day timeframe. Conduct Data Protection Impact Assessments for high-risk processing activities.

For the technical measures GDPR requires, see our encryption basics guide. To understand how GDPR compares to other regulations, explore our privacy legislation worldwide guide.

Data Protection Impact Assessment (DPIA)

GDPR requires DPIAs for processing activities likely to result in high risk to individuals’ rights and freedoms. This includes systematic and extensive profiling, large-scale processing of special category data, and systematic monitoring of publicly accessible areas.

A DPIA documents: the nature, scope, context, and purposes of processing; an assessment of necessity and proportionality; identification of risks to individuals; and measures to address those risks. The DPIA should be conducted before the processing begins, not after.

Practical Steps for Small Organizations

Even small organizations processing EU resident data must comply with GDPR. Start with a data mapping exercise to understand what personal data you collect and where it goes. Update your privacy notice to include GDPR-required information. Implement a process for handling data subject requests. Ensure you have a lawful basis for each processing activity. These foundational steps address the most common compliance gaps and demonstrate good-faith effort in the event of regulatory inquiry.

Enforcement Reality

GDPR enforcement has moved beyond warning letters to substantial fines. Meta received a 1.2 billion euro fine for data transfers. Amazon was fined 746 million euros for advertising practices. Smaller organizations also face enforcement: a Portuguese hospital was fined 400,000 euros for inadequate access controls. The message is clear: GDPR enforcement affects organizations of all sizes, and compliance is not optional for any entity processing EU resident data.