Home / Knowledge hub / GDPR
Knowledge hub
GDPR
The EU law governing personal data, with strict duties and large fines.
What it means
The GDPR, the General Data Protection Regulation, is the European Union's law on personal data, in force since May 2018. It sets rules for collecting, using, storing and sharing information about identifiable people, and gives those people rights over their data.
Its reach goes beyond Europe. It applies to organisations outside the EU that offer goods or services to people in the EU, or monitor their behaviour. A software company in India or the US with European customers can fall under it.
Why it matters
The penalties are large. Article 83 allows fines of up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher, for the most serious breaches, and up to 10 million euros or 2 percent for others. Customers also write the GDPR into contracts, so it affects sales as well as risk.
On security, Article 32 requires appropriate technical and organisational measures, including testing and evaluating their effectiveness regularly. Article 33 requires notice of a personal data breach to the supervisory authority within 72 hours where feasible. See breach notification. Both duties apply to any app that handles personal data of people in the EU.
How it shows up
Teams meet it as a set of working questions. What personal data do we hold and why? Which legal basis applies? Who are our processors? Where is the data stored and can it leave the EU? Can we delete one person's data when asked? Can we find out quickly if it has been exposed?
Application flaws turn into GDPR problems fast. A broken access control that lets one customer read another's records is a personal data breach. Keep a record of processing, collect only what you need (see data minimisation), and test the places personal data is shown, exported or searched. Compare with the Indian DPDP Act.
Questions people ask
GDPR, answered
Does GDPR apply to companies outside the EU?
Yes, if they offer goods or services to people in the EU or monitor their behaviour there. The location of the company does not decide it.
Check whether you target or track EU users, and get legal advice if unsure.
What is the difference between a controller and a processor?
A controller decides why and how personal data is used. A processor handles it on the controller's behalf. A software provider storing customers' data is often a processor.
Each has its own duties, and the contract between them must cover them.
How big can GDPR fines be?
Up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher, for the most serious infringements. Lower tiers apply to others.
Regulators also have other powers, such as ordering processing to stop.
Does GDPR require penetration testing?
It does not name penetration testing. Article 32 asks for appropriate security and a process for regularly testing and evaluating it, and testing is a common way to show that.
Keep the reports as evidence.
Is a data breach always reportable under GDPR?
Not if it is unlikely to result in a risk to people. Otherwise the authority must be told within 72 hours of awareness where feasible, and individuals when the risk is high.
Record every breach and the decision you made.
Sources
Where this comes from
Related
Terms that sit next to this one
Breach notification
Telling regulators and affected people about a data breach within a set time.
Data minimisation
Collecting and keeping only the personal data you actually need.
DPDP Act 2023
India's law on how organisations may collect, use and protect personal data.
PII
Any data that points at a specific human being.
Data breach
Information you hold ends up somewhere it should not be.
Can one customer read another's data?
Cross-account access, where one signed-in account reaches another's data, is a common route to a personal data breach. We check for it and report what we actually exploited. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.