The General Data Protection Regulation (GDPR) is defined by four core characteristics: its global reach, a risk-based approach to compliance, strict consent requirements, and strong data subject rights. These principles shift data protection from a technical obligation to a central part of business operations.
Global reach: jurisdiction beyond borders
GDPR applies not only to organizations based in the European Union but also to any entity outside the EU that processes the personal data of individuals located in the EU. This extraterritorial scope means a company in the United States, India, or elsewhere must comply if it offers goods or services to EU residents or monitors their behavior.
The law distinguishes between having an establishment in the EU and targeting EU audiences. Even without a physical presence, a business may fall under GDPR if it uses language, currency, or marketing aimed at EU customers. This principle ensures that data protection standards follow the individual, not the server.
Risk-based approach to data protection
Instead of prescribing specific technical measures, GDPR requires organizations to assess the risks their data processing poses to individuals’ rights and freedoms. The level of protection must match the nature, scope, and context of the processing activity.
This approach is reinforced by the principle of accountability. Organizations must not only comply but also demonstrate compliance through records of processing activities, data flow maps, and internal policies. This shifts privacy from a legal afterthought to a documented, ongoing responsibility.
When a data protection impact assessment is required
For high-risk processing—such as large-scale monitoring, automated decision-making, or processing of sensitive data—a Data Protection Impact Assessment (DPIA) is mandatory. This helps identify and mitigate risks before they materialize, especially in projects involving new technologies like AI or biometrics.
Strict rules on consent
Under GDPR, consent must be freely given, specific, informed, and unambiguous. Pre-checked boxes, default opt-ins, or vague terms do not count as valid consent. Individuals must be able to withdraw consent as easily as they gave it.
This requirement applies especially to non-essential data processing, such as marketing or profiling. For sensitive data, like health, religion, or biometrics, consent must meet an even higher standard. The goal is to ensure individuals have real control over how their data is used.
Strong rights for individuals
GDPR grants individuals a set of enforceable rights, including the right to access their data, correct inaccuracies, and request erasure under certain conditions. They can also object to processing, restrict its use, and receive their data in a portable format.
These rights are not theoretical. Organizations must respond to requests within one month and implement systems to honor them efficiently. The right to erasure, often called the 'right to be forgotten,' allows individuals to demand deletion of their data when it is no longer necessary or when consent is withdrawn.
Accountability and enforcement
Organizations must integrate data protection into their operations from the start, a principle known as 'Data Protection by Design and by Default.' This means privacy measures are built into products and services, not added later.
Enforcement is backed by significant penalties. Regulators can impose fines of up to €20 million or 4% of global annual turnover, whichever is higher, for serious violations. These penalties ensure that data protection receives attention at the highest levels of corporate leadership.