persondataforordning

Persondataforordningen, often referred to in English as the General Data Protection Regulation (GDPR), is the European Union regulation that governs how personal data may be collected, stored, used, and shared. It was adopted in 2016 and became enforceable on 25 May 2018, replacing the earlier Data Protection Directive. The regulation applies to the processing of personal data of individuals in the EU, and it also applies to organizations outside the EU that offer goods or services to, or monitor the behavior of, people inside the EU. In Denmark it is commonly called Persondataforordningen and is implemented together with national data protection legislation.

The GDPR establishes core processing principles and rights for data subjects. Key principles include lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. Data subjects have rights such as access to their data, rectification, erasure (the right to be forgotten), restriction of processing, data portability, and the right to object to processing, including profiling or automated decision-making. The regulation also requires clear information to be provided about how data is used.

Processing must have a lawful basis, such as consent, a contract, a legal obligation, vital interests, public task, or legitimate interests with a balancing test. The GDPR imposes specific obligations on data controllers and processors, including the possible designation of a Data Protection Officer (DPO) in certain cases and the performance of data protection impact assessments (DPIAs) for high-risk processing. It emphasizes security measures, data minimization, and the ability to demonstrate compliance.

Transfers of personal data to third countries require adequacy decisions or appropriate safeguards, such as standard contractual clauses or binding corporate rules. Enforcement is conducted by national data protection authorities; penalties for non-compliance can be substantial, up to 20 million euros or 4% of global annual turnover, whichever is higher.