The General Data Protection Regulation, Regulation (EU) 2016/679, sets European Union rules for processing personal data and securing it.
This page is a technical overview of that regulation and is not legal advice for any particular organization.
How it works
A controller decides why and how personal data are processed, while a processor handles those data only on the controller's documented instructions.
The rules push teams toward a stated purpose, toward collecting less, and toward keeping data only as long as that purpose still holds.
Security of processing means protecting confidentiality, integrity, and availability with measures matched to the risk, including access control and resilience.
The regulation also contains a duty to respond when a breach of personal data occurs, and the legal detail of that duty belongs with qualified counsel.
Concrete examples
- A shop records a customer's delivery address to ship an order and deletes the address when the return window has closed.
- A payroll provider processes employee data only under a contract that states the employer's instructions and the security expectations.
- An online service notices unauthorized access to profile data and starts the internal process its counsel designed for personal data breaches.
Protective measures
- Map which systems store personal data, why they store it, and who is the controller for each processing activity.
- Limit collection and retention to what the stated purpose actually needs, and review those limits on a schedule.
- Apply access control, encryption where it fits the risk, backups, and logging so the security duty is more than a slogan.
- Agree the breach handling path with counsel in advance so a technical team is not inventing legal steps during an incident.