What is the GDPR?The General Data Protection Regulation is a sweeping law that gives European citizens more control over their personal data and seeks to clarify rules and responsibilities for online services with European users.
It replaces the EU's previous directive governing data protection, passed in 1995, and makes some dramatic changes to existing conventions, including:
1) Unifying the rules for how companies should handle the data of European citizens
2) Expanding the scope of what's understood to be personal data
3) Clarifying the roles and responsibilities of those who control and process data
4) Streamlining enforcement authority to one supervisor per member state
5) Compelling companies to notify consumers of a data breach within 72 hours
6) Intensifying the penalties for noncompliance
When does the GDPR take effect?The regulation was ratified in 2016 and organizations have been given a two-year "implementation period" to prepare. This grace period ends on May 25, 2018, when enforcement begins in earnest.
Does this law apply only to companies based in the European Union?No and this is why it's major international news. The GDPR applies to any organization that collects, processes, manages or stores the data of European citizens.
This includes most major online services and businesses that collect, process, manage or store data. As such, the GDPR essentially sets a new global standard for data protection.
Who enforces the GDPR?The European Union parliament passed the law in April 2016, and each member state will have its own supervising authority.
What kind of data does the GDPR protect? The regulation applies to a broad array of personal data including name, ID numbers and location, as well as IP addresses, cookies and other digital fingerprints.
Here's how the EU's Protection Supervisor defines it:
"Personal data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.