GDPR

GDPR (General Data Protection Regulation) is a European Union law that protects personal data of EU residents. It applies to all organizations handling personal data, including those outside the EU.

Core Principles

Lawfulness, Fairness, Transparency: Process data legally and openly.
Purpose Limitation: Collect data only for specific, legitimate purposes.
Data Minimization: Only collect necessary data.
Accuracy: Keep data correct and up to date.
Storage Limitation: Keep data only as long as needed.
Integrity & Confidentiality: Protect data against breaches.

Key Rights

Access: Request copies of personal data.
Rectification: Correct inaccurate or incomplete data.
Erasure: Request deletion (“right to be forgotten”).
Data Portability: Receive data in a transferable format.
Right to Object: Opt-out of marketing or profiling.
Automated Decision Rights: Challenge automated decisions.

Practical Example

Organizations obtain explicit consent before sending marketing emails, encrypt personal data, provide portals for users to manage their data, conduct audits, and report breaches within 72 hours.

Cybersecurity Implications

GDPR requires strong cybersecurity measures: access controls, encryption, monitoring, and secure data handling. Non-compliance can result in penalties up to €20 million or 4% of global annual revenue.

Bottom line: GDPR protects personal data, mandates secure handling, and aligns closely with cybersecurity best practices.