The GDPR is a European Union data-protection regulation that governs how organizations collect, use, and safeguard the personal data of individuals in the EU and EEA, and grants those individuals defined rights over their data.
The General Data Protection Regulation (GDPR) is a comprehensive data-protection law of the European Union that took effect in 2018. It harmonized data-protection rules across EU member states and replaced earlier, more fragmented frameworks. The GDPR applies throughout the EU and the broader European Economic Area (EEA), and it is enforced by national data-protection authorities working within a coordinated structure.
A defining feature of the GDPR is its broad territorial scope. The regulation can apply not only to organizations established in the EU but also to organizations outside the EU that offer goods or services to individuals in the EU or that monitor their behavior. As a result, many businesses based elsewhere, including in the United States, may fall within the GDPR's reach depending on whom they target and how they handle data.
The GDPR is built on a set of core principles for processing personal data, including lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. Organizations must generally identify a valid lawful basis for processing, such as consent or legitimate interests, and they are expected to be able to demonstrate how they meet these principles rather than simply asserting compliance.
The regulation grants individuals, referred to as data subjects, a range of rights over their personal data. These can include rights to access their data, to have inaccurate data corrected, to have data erased in certain circumstances, to restrict or object to processing, and to data portability. Organizations are typically expected to provide clear privacy information and to respond to valid requests within defined timeframes, which means having processes in place to locate and act on personal data.
Enforcement under the GDPR can be substantial, and the regulation provides for significant administrative fines as well as other corrective measures. It also imposes obligations such as maintaining records of processing, conducting data-protection impact assessments for higher-risk activities, and notifying authorities of certain personal-data breaches within tight timeframes. The exact obligations depend on an organization's role as a controller or processor and on the nature of its processing.
This entry offers general information and is not legal advice. The GDPR is a detailed regulation whose application depends heavily on specific facts, including where individuals are located, what data is processed, and the purposes involved. Organizations should seek qualified legal guidance to assess their obligations and design appropriate compliance measures.
MediaBloom serves more than 300 businesses and builds its platform with data-protection expectations in mind, supporting practices such as handling personal data carefully and honoring data-subject requests where applicable. These design choices are intended to help customers operate responsibly, but each organization remains responsible for determining how the GDPR applies to its own activities and for meeting its obligations accordingly.
Key takeaways
- An EU data-protection regulation effective in 2018 across the EU and EEA.
- Has extraterritorial reach to organizations targeting or monitoring EU individuals.
- Built on principles like lawfulness, data minimization, and accountability.
- Grants data-subject rights such as access, rectification, and erasure.
Related terms
CCPA
The CCPA is a California privacy law that gives California consumers rights over their personal information and requires covered businesses to disclose their data practices and honor consumer requests.
HIPAA
HIPAA is a U.S. federal law that sets national standards for protecting the privacy and security of individuals' health information held by healthcare providers, health plans, and their business associates.
CRM
A CRM, or customer relationship management system, is software that stores and organizes a company's contacts, deals, and interaction history in one place. It serves as the central record for sales and customer relationships.
Cold Email
Cold email is an unsolicited but targeted outreach email sent to a prospect with no prior relationship, written to start a relevant business conversation.