andmekaitsemääruses

Andmekaitsemäärus, often referred to as the GDPR (General Data Protection Regulation) in English, is a significant piece of legislation enacted by the European Union. Its primary purpose is to strengthen and unify data protection for individuals within the EU and the European Economic Area. The regulation came into effect on May 25, 2018, replacing the previous Data Protection Directive 95/46/EC.

The GDPR grants individuals more control over their personal data. Key principles include the lawful, fair, and transparent processing of data, the collection of data only for specified, explicit, and legitimate purposes, and data minimization, meaning only necessary data should be collected. Organizations are also required to ensure the accuracy of data, limit its storage, and process it in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

The regulation applies to any organization processing the personal data of EU residents, regardless of where the organization is located. This extraterritorial reach means businesses outside the EU must comply if they offer goods or services to, or monitor the behavior of, individuals within the EU.

Key rights granted to individuals under the GDPR include the right to access their data, the right to rectification, the right to erasure (the "right to be forgotten"), the right to restrict processing, the right to data portability, and the right to object to processing. Organizations must obtain explicit consent for data processing in many cases and have a duty to report data breaches promptly. Non-compliance can result in substantial fines.