General Data Protection Regulation

It should come as no surprise that there would be strict laws protecting people’s data from large organisations and the government in a future where data is seen as the most valuable resource. In Europe, the GDPR, or General Data Protection Regulation, has replaced older data privacy laws that were nearly two decades old, some of which were initially developed in the 1990s. Since then, our data-intensive lives have developed, and individuals often share their private information online without restriction. The GDPR is the world’s most robust collection of data protection laws. 

What is GDPR? 

To provide European Union citizens additional access to their personal information, a new set of regulations known as GDPR was created. It seeks to streamline the regulatory landscape for business so that everyone in the EU—citizens and companies—can fully take advantage of the digital economy. 

The GDPR establishes a new baseline for consumer rights surrounding personal data. Still, businesses will face challenges in implementing the necessary systems and procedures to remain compliant. 

Understanding GDPR 

Although adopted in 2016 by the European Parliament, the law didn’t prevail until May 2018. GDPR replaced a previous law, the Data Protection Directive and also provides standards for how information is transmitted, whether done wholly or mostly by digital means. This new EU framework has ramifications for organisations in all member states, people, and enterprises throughout Europe and beyond. 

In accordance with the terms of the GDPR, organisations are not only required to ensure that personal data is obtained legally and per strict guidelines but also that those who obtain and manage it are obligated to safeguard it from misuse and exploitation and to uphold the rights of data owners – or face penalties for doing otherwise. 


History of GDPR 

GDPR replaces the 1995 Data Protection Act and sets specific data protection regulations. Organisations must protect user data from accidental or unauthorised access, destruction, alteration, or unauthorised use. They must also ensure that data is quality controlled to protect against unauthorised access, alteration, or destruction. Lastly, they must take steps to ensure that individuals have the right to information about their data protection rights and access to it. 

Under the GDPR, organisations must provide customers with a data protection notice (DPN) specifying the specific rights that the customer has. Customers have the right to access their data, change their data protection settings, receive data protection notices in a Format that they can understand, and complain if they feel their rights have not been fully respected. 

In recent years, there have been various changes to GDPR. Important modifications to the GDPR’s provisions were made in 2021. One example is removing the privacy shield established to facilitate economic transactions between US corporations and EU residents. 

Principles of GDPR 


The seven guiding principles of GDPR are: 

  • Accuracy 
  • Lawfulness, fairness & transparency 
  • Data minimisation 
  • Storage restriction 
  • Integrity and confidentiality (security),  
  • Accountability.  

These principles are also known as the “core values” of the GDPR. However, one of the above principles, i.e., accountability, is new to data protection laws. The other principles are equivalent to those in place before the 1998 Data Protection Act in the UK. 


Impact of GDPR 

The GDPR has significantly impacted how companies process and protect the personal data of EU citizens. Many companies have had to change their data collection and processing practices to comply with the GDPR. Some companies have also stopped doing business with the EU to avoid complying with the GDPR. 

Under Article 83(5)(a), the highest administrative fines are applied to violations of the fundamental principles for processing personal data. This entails potential penalties of up to 4% of your entire annual international revenue or £17.5 million (US$21 million), whichever is larger. 

Fines under the GDPR are discretionary instead of compulsory. They must be “effective, proportional, and dissuasive” and be used case-by-case. 

Frequently Asked Questions

Companies need to do a few key things to comply with GDPR.  

  • First, they need to appoint a Data Protection Officer (DPO). This person is responsible for overseeing the company’s compliance with GDPR.  
  • Second, companies must implement policies and procedures to ensure that personal data is collected, stored, and processed in a way compliant with GDPR. This includes ensuring that personal data is only collected for specific, legitimate purposes, stored securely, and authorised individuals only access it.  
  • Finally, companies must provide individuals with information about their rights under GDPR and ensure they have a mechanism for exercising those rights. 

The term “GDPR compliance” refers to an organisation’s ability to handle personal data in accordance with the GDPR’s defined standards. To comply with the GDPR’s regulations on the use of personal data, enterprises must adhere to a set of rules. Moreover, it specifies eight rights for data subjects that offer some protections for people’s private information. 

The GDPR applies to any company that processes the personal data of EU citizens, regardless of where the company is located. This includes companies based outside the EU that offer goods or services to EU citizens or that collect or process the personal data of EU citizens. 


Any information about a natural person (referred to as a “data subject”) that relates to their professional, personal, or public life and can be used to directly or indirectly recognise that person is referred to as personal data under GDPR law. Examples include names, photos, email addresses, or even bank records. 

These also comprise any information that has been or might be connected to a person. Personal data includes a person’s phone number, credit card number, employee ID, account information, number plate information, appearance, customer number, or address. 


On April 14, 2016, the European Parliament adopted GDPR, which came into force on May 25, 2018.  

    Read the Latest Market Journal

    Weekly Updates 4/12/23 – 8/12/23

    Published on Dec 4, 2023 53 

    This weekly update is designed to help you stay informed and relate economic and company...

    Fibonacci Retracement: 2 Practical Ways To Trade The Markets

    Published on Nov 27, 2023 117 

    Overview It’s frustrating to be stopped-out of a trade, even for an experienced trader like...

    Weekly Updates 27/11/23 – 1/12/23

    Published on Nov 27, 2023 40 

    This weekly update is designed to help you stay informed and relate economic and company...

    How Corporate Actions Affect Your Options Position

    Published on Nov 23, 2023 761 

    Table summary Corporate Actions Δ in Option Symbol Δ in Contract Multiplier Δ in Strike...

    Weekly Updates 20/11/23 – 24/11/23

    Published on Nov 20, 2023 51 

    This weekly update is designed to help you stay informed and relate economic and company...

    Top traded counters in October 2023

    Published on Nov 16, 2023 322 

    Start trading on POEMS! Open a free account here! The market at a glance: The...

    Weekly Updates 13/11/23 – 17/11/23

    Published on Nov 14, 2023 48 

    This weekly update is designed to help you stay informed and relate economic and company...

    Weekly Updates 06/11/23 – 10/11/23

    Published on Nov 6, 2023 81 

    This weekly update is designed to help you stay informed and relate economic and company...

    Contact us to Open an Account

    Need Assistance? Share your Details and we’ll get back to you