GDPR explained: principles, rights and how organizations comply

A practical guide to EU data protection

Almost every organization processes personal data, whether it belongs to customers, employees, suppliers, or website visitors.

In the European Union, how that data may be collected, used, shared, and protected is governed by the General Data Protection Regulation (GDPR).

Since it began to apply, the GDPR has become a global reference point for privacy law and a regular topic in boardrooms, not only legal departments.

This guide explains what the GDPR is, who it applies to, its key principles and obligations, and how professionals can build GDPR expertise.

What is the GDPR?

The GDPR, formally Regulation (EU) 2016/679, is the EU’s main law on the protection of individuals with regard to the processing of personal data.

It has applied since 25 May 2018 and is directly applicable in all EU Member States. It also applies in the wider European Economic Area.

Its goals are to protect people’s fundamental right to data protection and to allow personal data to move freely within the EU under one consistent set of rules.

Who does the GDPR apply to?

The GDPR applies to organizations that process personal data and are established in the EU. It can also apply to organizations outside the EU when they:

• Offer goods or services to people in the EU, or
• Monitor the behaviour of people in the EU, for example through online tracking

Two roles are central:

• Controllers decide why and how personal data is processed.
• Processors process personal data on behalf of a controller, such as cloud, payroll, or marketing service providers.

Personal data means any information relating to an identified or identifiable person, from names and email addresses to identification numbers, location data, and online identifiers.

The seven GDPR principles

All processing of personal data must respect seven principles:

• Lawfulness, fairness, and transparency
• Purpose limitation – collect data for specified, explicit, and legitimate purposes
• Data minimization – use only the data that is necessary
• Accuracy – keep data accurate and up to date
• Storage limitation – keep data no longer than necessary
• Integrity and confidentiality – protect data with appropriate security
• Accountability – be able to demonstrate compliance

Accountability is especially important. It is not enough to comply; organizations must be able to show that they comply.

Lawful bases for processing

Every processing activity needs a lawful basis. The GDPR provides six:

• Consent
• Performance of a contract
• Compliance with a legal obligation
• Protection of vital interests
• Performance of a task in the public interest
• Legitimate interests

Consent is only one of these options, and it must be freely given, specific, informed, and unambiguous. Special categories of data, such as health data, are subject to additional conditions.

Rights of individuals

The GDPR gives individuals a set of rights over their personal data, including the right to:

• Be informed about how their data is used
• Access their data
• Rectification of inaccurate data
• Erasure, often called the “right to be forgotten”
• Restriction of processing
• Data portability
• Object to processing
• Not be subject to certain decisions based solely on automated processing

Organizations generally have one month to respond to a request, which can be extended in some cases.

Key obligations for organizations

Records and data protection by design

Organizations must keep records of processing activities where required and build data protection into systems and processes from the start, known as data protection by design and by default.

Data protection impact assessments

Where processing is likely to result in a high risk to individuals, a data protection impact assessment (DPIA) must be carried out before the processing begins.

Security and breach notification

Controllers and processors must implement appropriate technical and organizational security measures. A personal data breach must be reported to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals. Where the risk is high, the affected individuals must also be informed.

Processors and international transfers

Controllers must use processors that provide sufficient guarantees and must have a written contract with them. Transfers of personal data outside the EEA need a valid mechanism, such as an adequacy decision or standard contractual clauses.

The role of the data protection officer

Some organizations must appoint a data protection officer (DPO), including public authorities and organizations whose core activities involve large-scale regular and systematic monitoring of individuals or large-scale processing of special categories of data.

The DPO informs and advises the organization, monitors GDPR compliance, advises on DPIAs, and acts as the contact point for the supervisory authority. The role requires expert knowledge of data protection law and practice, and the DPO must be able to act independently.

What are the penalties?

GDPR fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements, and up to €10 million or 2% for others. Supervisory authorities can also order organizations to stop processing, and individuals can claim compensation for damage.

Is the GDPR changing?

In November 2025, the European Commission proposed targeted changes to the GDPR as part of its Digital Omnibus package, including changes related to the definition of personal data, AI development, and cookie rules.

As of October 2026, these proposals are still being negotiated between the Council and the European Parliament and are not yet law. The current GDPR rules continue to apply in full.

GDPR and ISO/IEC 27701

ISO/IEC 27701 is the international standard for privacy information management systems (PIMS). Its 2025 edition can be implemented as a standalone management system.

A PIMS helps organizations structure privacy governance, roles, risk management, and continual improvement. It supports GDPR compliance, although certification does not by itself prove legal compliance.

Training paths for the GDPR

Professionals can build GDPR expertise through several PECB training paths available at MIC:

GDPR Foundation

A good starting point for professionals who need to understand the GDPR’s core concepts, principles, and requirements.

GDPR Certified Data Protection Officer

This course develops the competence to support an organization’s GDPR compliance program and to perform the tasks of a data protection officer. It is particularly relevant to DPOs, privacy and compliance professionals, legal advisers, and consultants.

ISO/IEC 27701 Lead Implementer

For professionals who want to establish and manage a privacy information management system that supports data protection compliance.

Start your GDPR learning journey with MIC

Data protection is now a core business responsibility, and organizations need professionals who can turn GDPR requirements into practical processes.

My ISO Certification (MIC) provides access to official PECB training, with study materials, the exam, and the certification application fee included.

Ready to become a data protection professional?

Explore the GDPR Certified Data Protection Officer course and take the next step toward building your expertise in data protection.

---