EUtietosuojalainsäädäntöön

EUtietosuojala, often referred to as the General Data Protection Regulation (GDPR), is a comprehensive legal framework enacted by the European Union to protect the personal data and privacy of individuals within the EU and EEA. It came into effect on May 25, 2018, replacing the Data Protection Directive of 1995.

The core objective of EUtietosuojala is to give individuals greater control over their personal data and to harmonize data protection laws across Europe. It applies to any organization that processes the personal data of EU residents, regardless of where the organization is located. This includes collecting, storing, using, and transferring personal information.

Key principles enshrined in EUtietosuojala include lawfulness, fairness, and transparency in data processing. Organizations must obtain explicit consent for data collection, and individuals have the right to access, rectify, erase, and restrict the processing of their data. Data portability is also a significant right, allowing individuals to receive their data in a structured, commonly used, and machine-readable format.

EUtietosuojala also mandates strict security measures for data processing and requires organizations to notify supervisory authorities and affected individuals in the event of a data breach. Non-compliance can result in substantial fines, up to 4% of annual global turnover or €20 million, whichever is higher. The regulation has had a significant global impact, influencing data protection practices worldwide.