The EU GDPR obliges any entity that handles personal data of EU residents to follow a set of strict rules covering accountability, security, breach handling and international transfers.
Accountability and documentation
Under Article 5(2) the controller must not only obey the rules but also prove it. This means keeping a comprehensive Record of Processing Activities (ROPA) that details what data is collected, why, where it is sent and how long it is retained (Article 30).
Risk assessment and data protection officer
When processing is likely to pose a high risk to individuals, a Data Protection Impact Assessment (DPIA) must be carried out before the activity begins. The DPIA evaluates necessity, proportionality and safeguards.
Public authorities, organisations that monitor individuals systematically, or those processing large volumes of special‑category data must designate a Data Protection Officer (DPO). The DPO monitors compliance, advises management and liaises with supervisory authorities.
Security and breach management
Article 32 requires controllers and processors to implement appropriate technical and organisational measures—such as pseudonymisation, encryption, role‑based access and regular testing—to protect data.
If a breach is likely to affect individuals' rights, the organisation must notify the relevant supervisory authority without undue delay and no later than 72 hours after becoming aware of it. When the breach presents a high risk, affected individuals must also be informed directly.
Cross‑border data transfers
Personal data may only leave the European Economic Area (EEA) if the destination ensures an equivalent level of protection. Acceptable mechanisms include:
- Standard Contractual Clauses (SCCs) – pre‑approved contract terms between exporter and importer.
- Binding Corporate Rules (BCRs) – regulator‑approved internal policies for intra‑group transfers.
- Transfer Impact Assessments – evaluation of the destination country's laws to confirm that safeguards will be effective.
Enforcement and penalties
Supervisory authorities can impose administrative fines up to €20 million or 4 % of worldwide annual turnover, whichever is higher, for serious infringements such as violating core principles or data‑subject rights. Lesser breaches can attract fines up to €10 million or 2 % of turnover. Individuals may also seek compensation through the courts.