DSGVO

DSGVO, Datenschutz-Grundverordnung, known in English as the General Data Protection Regulation (GDPR), is the European Union regulation that governs data protection and privacy. It entered into force on May 25, 2018, replacing the 1995 EU data protection directive. The regulation applies to the processing of personal data by public authorities and private entities within the EU and, in certain cases, to entities outside the EU.

Scope and principles: The DSGVO applies to processing of personal data of individuals in the EU and to organizations outside the EU that offer goods or services to, or monitor the behavior of, people in the EU. It is built on principles of lawfulness, fairness, transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability.

Rights and bases: Individuals have rights to access, rectify, erase, restrict processing, data portability, object to processing, and challenge automated decisions with safeguards. Processing must be based on lawful grounds such as consent, performance of a contract, legal obligation, vital interests, public task, or legitimate interests.

Obligations and protections: Controllers and processors must implement data protection by design and by default, maintain records of processing activities, conduct data protection impact assessments for high-risk processing, appoint a data protection officer where required, and report data breaches within 72 hours to the supervisory authority and, when appropriate, to data subjects. Sanctions include fines up to 20 million euros or 4% of global annual turnover, whichever is higher.

Enforcement and transfers: The regulation is enforced by independent supervisory authorities in each member state. It provides for cross-border cooperation and mechanisms for transfers to countries outside the EU, such as adequacy decisions and standard contractual clauses, to ensure an adequate level of protection.