GDPRjának

GDPR, or the General Data Protection Regulation, is a comprehensive data protection and privacy law that was enacted by the European Union in 2018. It aims to give control to individuals over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU. The regulation applies to all companies processing and holding the personal data of people within the EU, regardless of the company's location.

The GDPR introduces several key principles, including the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, and the right to object. It also establishes the concept of "data protection by design" and "data protection by default," meaning that data protection should be integrated into the design of systems and processes, and that the most privacy-preserving settings should be the default.

The regulation imposes strict requirements on data controllers and processors, including the need to obtain explicit consent from individuals for the processing of their personal data, to appoint a Data Protection Officer (DPO) in certain cases, and to conduct regular data protection impact assessments. It also introduces significant fines for non-compliance, with the maximum penalty being 20 million euros or up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher.

The GDPR has had a significant impact on the global data protection landscape, influencing the development of data protection laws in other regions and driving changes in business practices worldwide. It has also led to the establishment of the European Data Protection Board (EDPB) to provide guidance and support to national data protection authorities.