What is GDPR?

Q: What are the main obligations of the GDPR?

Inform the data subjects clearly and accessibly about the use of their data (purpose, retention period, rights, etc.). Justify a legal basis for each processing (consent, contract, legitimate interest, etc.). Respect the rights of data subjects (access, rectification, erasure, objection, etc.). Ensure the security of personal data: appropriate technical and organizational measures must be implemented to protect data against risks of loss, unauthorized access, or disclosure. Document all processing activities in a record , especially starting from 250 employees or in the case of sensitive or non-occasional processing. Notify data breaches to the CNIL (or other competent authority) within 72 hours, and sometimes, to the affected data subjects. Frame relationships with subcontractors through formalized contracts, to ensure their compliance with GDPR requirements and clarify each party's responsibilities.

Marine Boquien

April 30, 2024·4 minutes read time

The GDPR, or General Data Protection Regulation, is a European Union regulation aimed at protecting individuals' personal data. It came into effect on May 25, 2018 and establishes strict rules for the collection, processing, and storage of data, as well as penalties for non-compliance. Its goal is to harmonize data protection practices across the EU and ensure the confidentiality and security of personal information.

The full text of the regulation can be downloaded from this link.

GDPR

The GDPR aims to give individuals more control over their personal data and to instill greater trust in how businesses and institutions handle this data. Key principles at the heart of the GDPR are designed to protect privacy and individuals' rights.

3 Objectives:

Enhancing individuals' rights
Encouraging responsibility for data-handling stakeholders
Increasing the legitimacy of regulation through closer collaboration between data protection authorities

The GDPR applies to any organization, regardless of size or geographic location:

located within the European Economic Area (EU + Liechtenstein + Norway + Iceland). or
collecting, processing, or storing personal data of individuals located within the European Economic Area (EU + Liechtenstein + Norway + Iceland).

This includes:

companies
non-profit organizations
governmental institutions
marketing agencies
online service providers
and any other entity processing personal data in the course of their commercial activities or interactions with individuals from the EU.
Additionally, the GDPR also applies to processors and service providers handling personal data on behalf of an organization subject to the regulation.

In summary, any entity that handles personal data of EU citizens must comply with the provisions of the GDPR.

One of the key aspects of the GDPR is the requirement for a legal basis to process data, which includes consent. In certain cases, organizations must obtain clear and specific consent from individuals before collecting and processing their personal data. This consent must be freely given, informed, and revocable at any time by the individual. Six legal bases allow for the processing of personal data:

consent
legitimate interests
vital interests
public interest
legal obligation
contract

Rights of individuals

The regulation also grants individuals a number of rights regarding their personal data. These include the right of access, allowing individuals to know what data is held about them, and the right to data portability, enabling them to easily transfer their data from one service to another.

Responsibility

Another key principle of the GDPR is accountability and transparency. Organisations must be able to demonstrate their compliance by implementing appropriate data protection measures and maintaining accurate, up-to-date records of their data processing activities.

The GDPR also introduces severe penalties for non-compliance. Data protection authorities are empowered to impose fines of up to 4% of a company's annual global turnover or €20 million, whichever is higher.

The GDPR aims to create an environment where individuals have control over their own data and organizations handle this data in a responsible and ethical manner.

While its implementation may pose a challenge for many businesses, the GDPR represents a significant step towards better privacy protection and individual rights in the digital age.

GDPR sanction

Want to comply with the GDPR? Dastra software offers many features to help you meet data protection standards. To find out more, contact one of our experts !

More articles about GDPR

What are the main obligations of the GDPR?

Inform the data subjects clearly and accessibly about the use of their data (purpose, retention period, rights, etc.).
Justify a legal basis for each processing (consent, contract, legitimate interest, etc.).
Respect the rights of data subjects (access, rectification, erasure, objection, etc.).
Ensure the security of personal data: appropriate technical and organizational measures must be implemented to protect data against risks of loss, unauthorized access, or disclosure.
Document all processing activities in a record, especially starting from 250 employees or in the case of sensitive or non-occasional processing.
Notify data breaches to the CNIL (or other competent authority) within 72 hours, and sometimes, to the affected data subjects.
Frame relationships with subcontractors through formalized contracts, to ensure their compliance with GDPR requirements and clarify each party's responsibilities.

What are the 3 principles of the GDPR?

The three main principles of the general data protection regulation are:

Transparency, fairness, and legality: Personal data must be collected and processed in a transparent, lawful, and fair manner. This involves informing the data subjects about how their data will be used and ensuring that they provide informed consent.
Data minimization: Only the data necessary for the specific purpose should be collected. This principle encourages companies to limit the amount of personal data they process, thereby reducing risks to individuals' privacy.
Security and confidentiality: Personal data must be protected against unauthorized access, processing, or disclosure. Companies must implement technical and organizational measures to ensure the security of the personal data they process.

What are the prohibitions of the general data protection regulation?

The GDPR prohibits the collection and use of data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as the processing of genetic data, biometric data allowing for the unique identification of a person, health information, or data related to an individual's sexual life or sexual orientation.

However, there are exceptions to this prohibition, including:

If the data subject has given explicit consent, which must be free, specific, informed, and preferably in writing.
If the information has been manifestly made public by the data subject.
If this data is necessary for the protection of human life.
If its use is justified by a public interest and authorized by the CNIL.
If it concerns members or affiliates of an association or political, religious, philosophical, or trade union organization.

AI Act Transparency Notice Template (Word Format) Compliant with Article 50

White paper

Marine Boquien

See Dastra in action

In just a few minutes, schedule a personalized demo and discover how Dastra can adapt to your organization.

Ask for a demo

What is GDPR?

Definition of the GDPR

What is the objective of the GDPR?

Who is affected by the GDPR?

Legal bases, including consent