Dataforordningen

Dataforordningen, known in English as the General Data Protection Regulation (GDPR), is a comprehensive regulation adopted by the European Union to harmonise data privacy laws across Member States. It entered into force on 25 May 2018 and replaced the former EU Data Protection Directive. The regulation applies to all organisations that process the personal data of individuals residing within the EU, regardless of the organisation’s location, provided that the processing is related to the offering of goods or services to those individuals or the monitoring of their behaviour.

Key principles of the Dataforordningen include lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. The regulation introduces a set of individual rights such as the right to access, rectify, erase, restrict processing, data portability, and to object. Organisations are required to maintain records of processing activities, conduct data protection impact assessments for high‑risk processing, and, in many cases, appoint a Data Protection Officer.

Under the Dataforordningen, the European Data Protection Board (EDPB) coordinates the enforcement and interpretation of the regulation across the EU, while national supervisory authorities oversee national implementation. Breaches of the regulation can result in substantial fines: up to €20 million or 4% of an organisation’s annual global turnover, whichever is higher.

The Dataforordningen has had a global impact, influencing data protection laws outside the EU and prompting organisations worldwide to adopt stronger privacy safeguards. Its emphasis on individual control and accountability has reshaped how businesses handle personal data, fostering a culture of privacy by design and privacy by default.