General Data Protection Regulation (GDPR) Definition and Meaning

What Is the General Data Protection Regulation (GDPR)?

The General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection and processing of personal information from individuals who live and outside of the European Union (EU). Approved in 2016, the GDPR went into full effect two years later. Its aim is to give consumers control over their own personal data by holding companies responsible for the way they handle and treat this information. The regulation applies regardless of where websites are based, which means it must be heeded by all sites that attract European visitors, even if they don't specifically market goods or services to EU residents.

Understanding the General Data Protection Regulation (GDPR)

The General Data Protection Regulation (or GDPR for short) is a law that was approved by the European Union in April 2016 and went into effect on May 25, 2018. It replaced an earlier law, the Data Protection Directive, and was set up to regulate the way companies process and use the personal data they collect from consumers online. It also has rules in the way that information is moved, whether that's partly or entirely through automated means.

The law makes it difficult for companies to mislead consumers with confusing or vague language when they visit their websites. It also ensures:

• Website visitors are notified of the data collected.
• Visitors explicitly consent to that information-gathering by clicking on a button or some other action.
• Sites notify visitors in a timely way if any of their personal data held by the site is ever breached
• There is a mandated assessment of the site's data security.
• Whether a dedicated data protection officer (DPO) needs to be hired or an existing staffer can carry out this function.

These requirements may be more stringent than those required in the jurisdiction in which the site is located.

Information on how to contact the DPO and other relevant staffers must be accessible so that visitors may exercise their EU data rights, which also includes the ability to have their presence on the site erased, among other measures. The site must also add staff and other resources to be capable of carrying out such requests.

Special Considerations

As further protection for consumers, the GDPR also calls for any personally identifiable information (PII) that sites collect to be either anonymized (rendered anonymous) or pseudonymized with the consumer's identity replaced with a pseudonym.

This allows firms to do more extensive data analysis, such as assessing the average debt ratios of their customers in a particular region—a calculation that might otherwise be beyond the original purposes of data collected for assessing creditworthiness for a loan.

The regulation applies to all 27 members of the EU and the European Economic Area (EEA), regardless of where websites and residents are based. As such, it must be heeded by all sites that attract European visitors, even if they don't specifically market goods or services to EU residents. So the regulation applies to the data of an EU citizen even if it is housed in the U.S. Similarly, a U.S. citizen who resides in the EU is covered whenever they visit sites based in the union.

Criticism of the GDPR

The GDPR has attracted criticism in some quarters. Some say that the requirement to appoint DPOs, or simply to assess the need for them imposes an undue administrative burden on certain companies. Some complain that the guidelines are too vague on how best to deal with employee data.

In addition, data cannot be transferred to another country outside the EU, unless the receiving company guarantees the same degree of protection as the EU requires. This has led to complaints about costly disruption to business practices.

There's a further concern that the costs associated with GDPR will increase over time, in part because of the escalating need to educate customers and employees alike about data protection threats and solutions. There's also skepticism over how feasibly data protection agencies across the EU and beyond can align their enforcement and interpretation of the regulations, and so assure a level playing field as the GDPR goes into fuller effect.

The Bottom Line

Businesses collect personal data and they have often sold that information—sometimes without the consent of their consumers. But laws have been put into place in parts of the world to help protect individuals. Rules under the General Data Protection Regulation went into effect in the European Union in 2018. Under the law, companies must protect consumer data and inform them how their information is used. It has a broad reach, extending beyond the borders of the EU.