General Data Protection Regulation (GDPR)

Lawfulness, fairness and transparency

Personal data must be processed lawfully, fairly, and in a transparent manner in relation to the data subject.

Purpose limitation

Personal data must be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.

Data minimisation

Personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.

Accuracy

Personal data must be accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that personal data that are inaccurate are erased or rectified without delay.

Storage limitation

Personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

Integrity and confidentiality

Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

Right to be informed

Individuals have the right to be informed about the collection and use of their personal data.

Right of access

Individuals have the right to access their personal data and supplementary information.

Right to rectification

Individuals are entitled to have personal data rectified if it is inaccurate or incomplete.

Right to erasure (Right to be forgotten)

Individuals have the right to request the deletion or removal of personal data when there is no compelling reason for its continued processing.

Right to restrict processing

Individuals have the right to restrict the processing of their personal data.

Right to data portability

Individuals have the right to obtain and reuse their personal data for their own purposes across different services.

Data Protection Officer (DPO)

Organizations must appoint a DPO in certain cases, such as when processing is carried out by a public authority or when core activities involve regular and systematic monitoring of data subjects on a large scale.

Data Protection Impact Assessment (DPIA)

Organizations must conduct a DPIA when processing is likely to result in a high risk to individuals.

Breach notification

Organizations must notify the relevant supervisory authority of a data breach within 72 hours of becoming aware of it.

Records of processing activities

Organizations must maintain records of processing activities under their responsibility.