General Data Protection Regulation (GDPR)

It applies to organisations established in the EU, and also to those outside it that offer goods or services to people in the EU or monitor their behaviour. Its principles include lawfulness, fairness and transparency, purpose limitation, minimisation, accuracy, storage limitation, security and accountability. Every use needs a legal basis, such as consent, contract or legitimate interests. People get rights to access, correct, erase and port their data. Controllers must run impact assessments for high-risk processing, notify serious breaches and, in set cases, appoint a data protection officer. Fines can reach the higher of a fixed sum or a percentage of worldwide annual turnover. National authorities enforce it, with the European Data Protection Board coordinating. Many other countries have modelled laws on it. Its reach beyond EU borders is why firms worldwide check their practices against it.

A software company based outside Europe sells a subscription app to customers in several EU countries. Its privacy lead concludes the GDPR applies because the company targets EU residents. The firm appoints an EU representative, updates its notices, signs processor contracts with its vendors and sets a process for rights requests.