Businesses processing personal data of EU/EEA residents must comply with the General Data Protection Regulation (GDPR) regardless of where the business is located. Compliance requires establishing a lawful basis for processing (consent, contract, legitimate interest, legal obligation, vital interest, or public task), appointing a Data Protection Officer where required, implementing data protection by design and default, and maintaining records of processing activities. Organizations must respond to data subject rights requests (access, rectification, erasure, portability, objection) within one month. [src1, src2]
Since enforcement began in May 2018 through February 2026, EU Data Protection Authorities have issued over EUR 4.5 billion in cumulative GDPR fines. Tier 1 violations (breaching core principles) carry penalties up to EUR 20 million or 4% of global annual turnover, whichever is higher. Tier 2 violations (specific obligations like processor duties) carry penalties up to EUR 10 million or 2% of turnover. Data breaches must be reported to the supervisory authority within 72 hours, and to affected individuals without undue delay if the breach poses high risk. The European Commission proposed targeted amendments in Q4 2025 that will reshape cookie consent, expand SME exemptions, and clarify AI obligations under the EU AI Act taking full effect on 2 August 2026. [src1, src2, src3]
The GDPR replaced the 1995 Data Protection Directive to create a unified framework across the EU, eliminating the patchwork of 28 different national laws. Its extraterritorial scope ensures that EU residents' data is protected regardless of where it is processed, and the severe penalty structure (up to 4% of global turnover) creates a credible deterrent that has driven widespread adoption of privacy-by-design practices even among non-EU companies. [src1, src3]
START -- User needs privacy/data protection compliance guidance
|-- Which jurisdiction?
| |-- EU/EEA residents --> GDPR Summary <-- YOU ARE HERE
| |-- California residents --> CCPA/CPRA Summary
| |-- Japan residents --> APPI Japan Summary
| |-- Brazil residents --> LGPD Brazil Summary
| +-- Multiple jurisdictions --> Cross-Border Data Transfers unit
|-- Does the organization process personal data of EU/EEA individuals?
| |-- YES --> Apply GDPR: lawful basis, DPO, DPIA, breach notification
| +-- NO --> GDPR does not apply; check other jurisdiction rules
+-- Is there an existing privacy program?
|-- YES --> Audit against GDPR Articles 5-49
+-- NO --> Start with data mapping and processing records (Article 30)Organizations default to legitimate interest for all non-consent processing without documenting the three-part test. Meta was fined EUR 390 million for claiming behavioral advertising was "necessary" to provide social media services. [src2]
Each legitimate interest claim must pass the three-part test: (1) identify the legitimate interest, (2) show processing is necessary, (3) balance against individual rights. Document and revisit when processing changes. [src1]
Making "Reject All" harder to find than "Accept All," using pre-ticked boxes, or firing cookies before consent. EU DPAs issue per-session fines for each affected user. [src3]
Present Accept and Reject options with equal prominence on the first layer. No cookies fire before affirmative consent. Maintain timestamped consent logs. [src2]
Shadow IT, exported CSVs, test environments, and backups retain personal data indefinitely after erasure requests, creating ongoing Article 17 violations. [src4]
Map all locations where personal data exists -- production, backups, analytics, exports, vendor systems. Implement systematic erasure with documented exception processes for legal holds. [src1]
Misconception: GDPR only applies to companies headquartered in the EU.
Reality: GDPR applies to any organization worldwide that processes EU/EEA resident data, offers them goods/services, or monitors their behavior (Article 3). [src1]
Misconception: Pseudonymized data is exempt from GDPR.
Reality: Pseudonymized data remains personal data under GDPR because it can be re-identified. Only fully anonymized data (irreversible) falls outside scope. [src1]
Misconception: A DPO is required for every organization.
Reality: A DPO is mandatory only for public authorities, organizations conducting large-scale systematic monitoring, or those processing special category data at scale. [src2]
Misconception: GDPR compliance is a one-time project.
Reality: GDPR requires ongoing compliance: regular audits, updated DPIAs, continuous training, and monitoring of regulatory changes. The 2026 EDPB coordinated action focuses on transparency (Articles 12-14). [src3]
| Rule/Framework | Key Difference | When to Use |
|---|---|---|
| GDPR (EU) | Opt-in model; 6 lawful bases; up to 4% global turnover penalty | Processing EU/EEA resident data |
| CCPA/CPRA (California) | Opt-out model; threshold-based; per-violation fines | Processing California resident data above thresholds |
| LGPD (Brazil) | 10 legal bases; BRL 50M cap; ANPD enforcement | Processing Brazilian resident data |
| APPI (Japan) | No size threshold; criminal penalties; PPC enforcement | Processing Japanese resident data |
Fetch this when a user asks about data privacy requirements for businesses operating in the EU, processing EU/EEA resident data, or offering goods/services to individuals in EU/EEA member states.