GDPRregulatsioon

GDPRregulatsioon, officially the General Data Protection Regulation, is a comprehensive data privacy and protection law enacted by the European Union. It came into effect on May 25, 2018, and aims to harmonize data privacy laws across all EU member states, while also offering enhanced rights to individuals regarding their personal data. The regulation applies to any organization that processes the personal data of EU residents, regardless of where the organization is based.

Key principles of GDPR include the lawful and fair processing of data, transparency with data subjects, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality. Individuals, referred to as data subjects, have strengthened rights such as the right to access their data, the right to rectification, the right to erasure (the "right to be forgotten"), the right to restrict processing, the right to data portability, and the right to object to processing.

Organizations are obligated to implement appropriate technical and organizational measures to ensure data security and to report data breaches to supervisory authorities and affected individuals in a timely manner. GDPR also mandates the appointment of a Data Protection Officer (DPO) in certain cases. Non-compliance can result in significant fines, calculated as a percentage of an organization's annual global turnover or a fixed amount, whichever is higher. The regulation has had a profound impact on how businesses handle personal data globally.