GDPR: General Data Protection Regulation (EU)

In force since May 25, 2018

The GDPR is the EU's main data protection law. It sets the rules for how personal data is collected, used and stored across the European Union and the wider European Economic Area (EEA).

It doesn't stop at Europe's borders. If your website tracks visitors in the EU, the GDPR applies to you wherever your business is based.

Personal data means anything that can identify a person, directly or indirectly. Names and email addresses count, but so do online identifiers like IP addresses and cookie IDs.

Under Article 6, you need at least one of these to process personal data:

• Consent: the person has clearly agreed
• Contract: you need the data to deliver something they signed up for
• Legal obligation: the law requires you to process it
• Vital interests: it protects someone's life
• Public task: it's part of an official or public interest function
• Legitimate interests: you have a genuine need that doesn't override the person's rights

• See the data you hold on them
• Correct it or have it deleted
• Limit or object to how you use it
• Take it to another provider
• Not be subject to purely automated decisions with significant effects

Fines reach up to €20 million or 4% of global annual turnover, whichever is higher. Regulators can also order you to stop processing data altogether.

The EU's Digital Omnibus package, proposed in November 2025, would amend parts of the GDPR and the EU's cookie rules. It's still being negotiated, so the current rules apply in full until anything is adopted.

• Official legislation here 
• Article on our blog here
• A legal perspective here