The GDPR (General Data Protection Regulation) is the European Union law that governs how organizations collect, use, store and protect the personal data of people located in the EU. It has applied since May 25, 2018, and it isn't limited to European companies: a business in the United States or Latin America that sells to customers in Europe or analyzes their online behavior may also have to comply with it.
These are the key facts to know whether it applies to you and what complying with it involves.
What GDPR is
The GDPR is Regulation (EU) 2016/679. It replaced a 1995 directive and brought the data protection rules of every European Union country together into a single text, so a company doesn't have to comply with 27 different laws.
It starts from a simple idea: personal data belongs to people, and the companies that use it are only handling it. That is why it requires every processing activity to have a legal justification, that only the necessary data be used, that it be kept only as long as essential and that it be protected with technical and organizational measures proportionate to the risk. Each member state has an authority that oversees compliance and can impose penalties.
8 key GDPR facts your company should know
1. It applies to companies outside the European Union
The GDPR reaches any organization, wherever it is based, that offers goods or services to people in the EU or monitors their behavior, for example through web analytics or personalized advertising. It also applies to anyone who processes data on behalf of a European company, such as a software or cloud service provider. If any of these situations describes your business, it is worth reviewing your obligations with a specialist.
2. It protects anyone who is in the EU, whether or not they are a European citizen
What counts is where the person is when their data is collected, regardless of nationality. An American tourist whose data is recorded by a hotel in Spain is protected by the GDPR; a French citizen living in the United States who shops at a US store that doesn't target Europe, in principle, is not.
3. You need a legal basis to process data, and consent is only one of them
The regulation recognizes six legal bases: consent, performance of a contract, a legal obligation, protection of vital interests, a task carried out in the public interest and legitimate interest. When the basis is consent, it must be freely given, specific, informed and unambiguous; pre-checked boxes or silence don't count, and the person can withdraw it at any time.
4. People have rights your company must be able to honor
They include access to their data, rectification, erasure (known as the right to be forgotten), restriction of processing, portability, objection and the right not to be subject to decisions made solely by algorithms with significant effects. As a general rule, the company has one month to respond, so it needs to know where each person's data lives.
5. The concept of personal data is very broad
It is any information that identifies a person or makes it possible to identify them, directly or indirectly. Beyond a name or email address, it includes IP addresses, cookie identifiers, location data or a device number. Health, biometric, ethnic origin or sexual orientation data, among others, form special categories with stronger protection.
6. If you are outside the EU, you may need a representative there
Companies with no establishment in the Union that fall under the GDPR must designate, in writing, a representative in one of the countries where the people whose data they process are located. The obligation has exceptions, such as occasional, low-risk processing that doesn't include sensitive data on a large scale. This is different from the data protection officer (DPO), who is mandatory only in certain cases.
7. Security breaches must be reported within 72 hours
If a breach puts the people whose data was exposed at risk, the company must notify the supervisory authority within 72 hours of detecting it, and notify those affected without undue delay when the risk is high. Meeting that deadline requires being able to detect the incident, understand what data was compromised and document everything.
8. Fines can reach 4% of worldwide revenue
The most serious infringements carry fines of up to €20 million or 4% of global annual revenue, whichever is higher; others, up to €10 million or 2%. Beyond fines, the authority can order a company to stop a processing activity, and affected individuals can claim compensation.
GDPR vs US privacy laws: key differences
The United States has no single federal privacy law comparable to the GDPR. Personal data is regulated by sector-specific federal laws, such as HIPAA for health information, and by a growing number of state laws, of which California's CCPA, as amended by the CPRA, is the best known. If your company falls within the GDPR's scope, it may have to comply with both:
| Aspect | GDPR | US privacy laws (e.g., CCPA/CPRA) |
|---|---|---|
| Scope | Data of people in the EU, even if the company is outside it | Varies by law; the CCPA covers California residents' data held by businesses that meet certain thresholds |
| Authority | A supervisory authority in each EU country | State regulators and attorneys general, such as the California Privacy Protection Agency, plus federal agencies by sector |
| Individual rights | Access, rectification, erasure, restriction, portability and objection | Under the CCPA: right to know, delete and correct data, and to opt out of its sale or sharing |
| Breach notification | To the authority within 72 hours and to those affected when the risk is high | Set by each state's breach notification law, with timelines and triggers that vary |
| Local representative | Required in the EU for many companies based elsewhere | No equivalent requirement |
| Penalties | The higher of €20 million or 4% of worldwide revenue | Civil penalties that vary by law and, in California, private lawsuits after certain breaches |
Both share the principle of protecting data with security measures proportionate to the risk, so the same technical controls support compliance with each of them.
How to start complying with the GDPR
- Confirm whether it applies to you. Check whether you sell to, provide services to or run analytics on people located in Europe, or whether you process information for European customers.
- Build a data inventory. What personal data you collect, from whom, for what purpose, where it is stored and who it is shared with.
- Assign a legal basis to each processing activity and update your privacy notice and consent forms.
- Set up a procedure to handle individuals' rights requests within the deadline.
- Review contracts with vendors that access that data, as well as any transfers outside the EU.
- Apply security measures based on risk: access control, encryption, backups and monitoring. The method for prioritizing them is in our guide to cybersecurity risk management.
- Define how you will detect and report a breach in under 72 hours.
At TecnetOne, we help with the technical side of that list. With TecnetSOC Agentic, our analysts, supported by AI agents, watch over your network, devices and cloud around the clock. They spot unauthorized access early enough for you to act within the notification window, and they keep a record of every incident as evidence for your audits.
Frequently asked questions about GDPR
It stands for General Data Protection Regulation, the European rule that governs how personal data is used.
Yes, when they offer products or services to people in the European Union, analyze their online behavior or process information on behalf of a European customer. A company that only serves customers in its own country, outside the EU, is generally not covered.
It is an EU regulation, Regulation (EU) 2016/679. That means it applies directly in every member state, with the same text for all of them, which is why a company doesn't have to follow a different data protection law in each country.
Only in some cases: public authorities, companies whose core activity is monitoring people on a large scale and companies that process special categories of data on a large scale, such as health information. Even when it isn't mandatory, it is a good idea to assign that responsibility to someone.
The deadline is 72 hours from when the company becomes aware of the breach to notify the supervisory authority, unless it is unlikely to cause harm. If the risk to people is high, they must also be informed without undue delay.
The ones that give you visibility into who accesses information and what they do with it: identity management, encryption, data loss prevention (DLP) and security event monitoring. Open-source tools such as Wazuh can support several of these controls.
If your infrastructure runs on Microsoft, Microsoft Sentinel can also centralize that monitoring.
