General Data Protection Regulation

It should come as no surprise that there would be strict laws protecting people’s data from large organisations and the government in a future where data is seen as the most valuable resource. In Europe, the GDPR, or General Data Protection Regulation, has replaced older data privacy laws that were nearly two decades old, some of which were initially developed in the 1990s. Since then, our data-intensive lives have developed, and individuals often share their private information online without restriction. The GDPR is the world’s most robust collection of data protection laws. 

What is GDPR? 

To provide European Union citizens additional access to their personal information, a new set of regulations known as GDPR was created. It seeks to streamline the regulatory landscape for business so that everyone in the EU—citizens and companies—can fully take advantage of the digital economy. 

The GDPR establishes a new baseline for consumer rights surrounding personal data. Still, businesses will face challenges in implementing the necessary systems and procedures to remain compliant. 

Understanding GDPR 

Although adopted in 2016 by the European Parliament, the law didn’t prevail until May 2018. GDPR replaced a previous law, the Data Protection Directive and also provides standards for how information is transmitted, whether done wholly or mostly by digital means. This new EU framework has ramifications for organisations in all member states, people, and enterprises throughout Europe and beyond. 

In accordance with the terms of the GDPR, organisations are not only required to ensure that personal data is obtained legally and per strict guidelines but also that those who obtain and manage it are obligated to safeguard it from misuse and exploitation and to uphold the rights of data owners – or face penalties for doing otherwise. 


History of GDPR 

GDPR replaces the 1995 Data Protection Act and sets specific data protection regulations. Organisations must protect user data from accidental or unauthorised access, destruction, alteration, or unauthorised use. They must also ensure that data is quality controlled to protect against unauthorised access, alteration, or destruction. Lastly, they must take steps to ensure that individuals have the right to information about their data protection rights and access to it. 

Under the GDPR, organisations must provide customers with a data protection notice (DPN) specifying the specific rights that the customer has. Customers have the right to access their data, change their data protection settings, receive data protection notices in a Format that they can understand, and complain if they feel their rights have not been fully respected. 

In recent years, there have been various changes to GDPR. Important modifications to the GDPR’s provisions were made in 2021. One example is removing the privacy shield established to facilitate economic transactions between US corporations and EU residents. 

Principles of GDPR 


The seven guiding principles of GDPR are: 

  • Accuracy 
  • Lawfulness, fairness & transparency 
  • Data minimisation 
  • Storage restriction 
  • Integrity and confidentiality (security),  
  • Accountability.  

These principles are also known as the “core values” of the GDPR. However, one of the above principles, i.e., accountability, is new to data protection laws. The other principles are equivalent to those in place before the 1998 Data Protection Act in the UK. 


Impact of GDPR 

The GDPR has significantly impacted how companies process and protect the personal data of EU citizens. Many companies have had to change their data collection and processing practices to comply with the GDPR. Some companies have also stopped doing business with the EU to avoid complying with the GDPR. 

Under Article 83(5)(a), the highest administrative fines are applied to violations of the fundamental principles for processing personal data. This entails potential penalties of up to 4% of your entire annual international revenue or £17.5 million (US$21 million), whichever is larger. 

Fines under the GDPR are discretionary instead of compulsory. They must be “effective, proportional, and dissuasive” and be used case-by-case. 

Frequently Asked Questions

Companies need to do a few key things to comply with GDPR.  

  • First, they need to appoint a Data Protection Officer (DPO). This person is responsible for overseeing the company’s compliance with GDPR.  
  • Second, companies must implement policies and procedures to ensure that personal data is collected, stored, and processed in a way compliant with GDPR. This includes ensuring that personal data is only collected for specific, legitimate purposes, stored securely, and authorised individuals only access it.  
  • Finally, companies must provide individuals with information about their rights under GDPR and ensure they have a mechanism for exercising those rights. 

The term “GDPR compliance” refers to an organisation’s ability to handle personal data in accordance with the GDPR’s defined standards. To comply with the GDPR’s regulations on the use of personal data, enterprises must adhere to a set of rules. Moreover, it specifies eight rights for data subjects that offer some protections for people’s private information. 

The GDPR applies to any company that processes the personal data of EU citizens, regardless of where the company is located. This includes companies based outside the EU that offer goods or services to EU citizens or that collect or process the personal data of EU citizens. 


Any information about a natural person (referred to as a “data subject”) that relates to their professional, personal, or public life and can be used to directly or indirectly recognise that person is referred to as personal data under GDPR law. Examples include names, photos, email addresses, or even bank records. 

These also comprise any information that has been or might be connected to a person. Personal data includes a person’s phone number, credit card number, employee ID, account information, number plate information, appearance, customer number, or address. 


On April 14, 2016, the European Parliament adopted GDPR, which came into force on May 25, 2018.  

    Read the Latest Market Journal

    Weekly Updates 5/6/23 – 9/6/23

    Published on Jun 5, 2023 10 

    This weekly update is designed to help you stay informed and relate economic and company...

    Weekly Updates 29/5/23 – 2/6/23

    Published on May 29, 2023 20 

    This weekly update is designed to help you stay informed and relate economic and company...

    Investing for the Long Term: A Lifestyle Choice

    Published on May 26, 2023 27 

    Fortune favours the prepared. Investing for the long-term is a lifestyle choice that can provide...

    A Peek into Singapore Market

    Published on May 23, 2023 46 

    Singapore market in 2023 review Singapore shares have experienced a roller coaster ride this year....

    Top traded counters in April 2023

    Published on May 22, 2023 225 

    Start trading on POEMS! Open a free account here! At a glance: Softening US Labour...

    Weekly Updates 22/5/23 – 26/5/23

    Published on May 22, 2023 18 

    This weekly update is designed to help you stay informed and relate economic and company...

    How Certain is Your Retirement in this Uncertain World?

    Published on May 16, 2023 35 

    A sharp recall was triggered when the world ushered in 2020. A huge wave of...

    Weekly Updates 15/5/23 – 19/5/23

    Published on May 15, 2023 19 

    This weekly update is designed to help you stay informed and relate economic and company...