What is the GDPR?
Everything your organization needs to know about the EU's General Data Protection Regulation
In 2016, the European Union enacted the General Data Protection Regulation — one of the most sweeping privacy laws ever written. Whether your organization is based in the EU or not, if you handle the personal data of EU individuals, the GDPR applies to you.
What is the GDPR?
GDPR stands for General Data Protection Regulation. It is EU law designed to strengthen electronic privacy and unify data protection rules across member states.
The GDPR's core goal is simple: return control of personal data to the individual. It requires organizations to be transparent about what data they collect, how they use it, and to honor requests from individuals to access, correct, or delete it.
The regulation applies to the personal data of all EU citizens — but its reach extends far beyond Europe's borders. Any business globally that collects, stores, or processes the personal data of EU individuals must comply. Key obligations include:
- Responding quickly to erasure requests ("right to be forgotten")
- Making personal data portable and accessible upon request
- Implementing appropriate technical and organizational security measures
- Reporting data breaches to authorities within 72 hours
⚠️ Enforcement note: Although the GDPR was adopted in 2016, EU Data Protection Authorities began enforcing it on May 25, 2018. Fines for non-compliance can reach up to €20 million or 4% of annual global turnover — whichever is higher.
What data does the GDPR regulate?
The scope of "personal data" under the GDPR is broader than most organizations expect. Some examples are obvious — email addresses, employee ID numbers, phone numbers. Others are less so.
Direct Identifiers
Names, email addresses, phone numbers, national ID numbers, employee IDs
Location & Behavioral Data
Geolocation data and behavioral tracking that can be traced back to a specific individual
Online Identifiers
IP addresses — a significant departure from prior privacy laws — if they can be combined with other data to identify a person
Sensitive Categories
Health data, biometric data, genetic data, religious beliefs, and political opinions receive heightened protection
Critically, the GDPR was written to be future-proof. It does not provide a finite list of regulated data types. The guiding principle: if a piece of data can identify a living EU individual — directly or indirectly — it counts as personal data.
IP addresses as personal data is a notable change from earlier frameworks like Safe Harbour and Privacy Shield. Under the GDPR, an IP address qualifies as personal data when it can be combined with other information to identify an individual.
The history of the GDPR
The EU has led on privacy law for decades. Understanding the GDPR's origins helps organizations appreciate why it carries such weight — and why compliance is non-negotiable.
EU Data Protection Directive
The EU adopted its landmark Data Protection Directive, broadly defining personal data as "any information relating to an identified or identifiable natural person." This became the foundation for privacy law across all EU member states for over two decades.
GDPR Adopted
The EU formally adopted the General Data Protection Regulation, replacing the 1995 Directive with a single, directly enforceable regulation across all member countries. A two-year transition period gave organizations time to prepare.
Enforcement Begins
On May 25, 2018, EU Data Protection Authorities began active enforcement. Organizations found in breach faced significant fines, and regulators across Europe launched investigations into major technology companies.
Key requirements for businesses
The GDPR introduced new obligations for any organization processing EU personal data — regardless of where in the world that organization is headquartered.
Lawful basis for processing
Every act of data collection or processing must have a documented lawful basis — such as consent, contract necessity, or legitimate interest.
Right to erasure
Individuals can request their personal data be deleted. Organizations must be able to locate and remove that data across all systems promptly.
Data portability
Individuals have the right to receive their personal data in a structured, machine-readable format and to transfer it to another service.
Breach notification
In the event of a data breach, organizations must notify the relevant supervisory authority within 72 hours of becoming aware of the incident.
Need help preparing your organization for GDPR compliance?
Iron Cove Solutions helps organizations implement the identity and access management infrastructure needed to meet GDPR obligations — from data access controls to audit trails and erasure workflows.