personopplysningsforordning

The personopplysningsforordning, commonly known as GDPR (General Data Protection Regulation), is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area. It also addresses the transfer of personal data outside the EU and EEA areas. The primary purpose of GDPR is to give individuals control over their personal data and to simplify the regulatory environment for international business by unifying data privacy within the EU.

GDPR applies to any organization, regardless of where it is located, that processes the personal data of individuals residing in the EU. This includes collecting, storing, using, and transferring personal data. The regulation sets out strict rules for how personal data must be handled, including requirements for obtaining consent, ensuring data accuracy, and implementing security measures to protect data from unauthorized access or breaches.

Key principles under GDPR include lawful processing, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. Individuals have several rights under GDPR, such as the right to access their data, the right to rectification, the right to erasure (the "right to be forgotten"), the right to restrict processing, the right to data portability, and the right to object to processing. Organizations are required to appoint a data protection officer in certain circumstances and to notify supervisory authorities and affected individuals in the event of a data breach. Non-compliance with GDPR can result in significant fines.