GDPR Summary

gdpr summery

Data protection law deconstructed: a complete summary of GDPR

The General Data Protection Regulation (GDPR) is a revolutionary new law that requires organisations to do more than just tick and untick some boxes. It needs them to make enterprise-wide changes and ultimately transform their business operations. Also, the cost of negligence can be very high and non-compliance can result in hefty fines of up to 20 million Euros or 4% of annual turnover (whichever is higher). So, organisations need to make sure that they are on the right side of GDPR. Here is a quick summary to help you understand the workings of this new regulation and discover whether your organisation is GDPR compliant or not.

The need of the hour

Data protection is a critical concern for everyone from governments to corporations to individuals today. And rightly so. As the use and misuse of personal data become more prevalent, the gaping holes in the existing data protection laws have come to the fore. Governments across the world are going back to the drawing board to make amends and create laws that address modern data privacy concerns and not those of a decade ago. European Union’s General Data Protection Regulation (GDPR) is a milestone in that direction. It replaces previous data protection laws in the EU states like the UK’s 20-year old Data Protection Act (DPA).

GDPR is a unified data protection law for all the people living within the European Union, which also expands oversight to data that is transferred out of the EU. This GDPR summary will highlight the fundamentals and then expand these in more detail.

GDPR Summary

What data is covered under GDPR?

General Data Protection Regulation (GDPR) explicitly states any data that identifies a natural person is classified as personal data. It doesn’t matter whether that data is collected by direct or indirect reporting; it can be in any format and processed in any way.

GDPR Summary


Consumers get a lot of power

Consumer data protection is the primary goal of GDPR. However, under this law, the consumer becomes significantly more empowered. GDPR eliminates a large number of loopholes in the previous set of rules. Consequently, without the knowledge of the consumer, organisations find it more difficult to obtain and process data. This GDPR summary covers, what rights the consumers have under GDPR.

Stricter rules for consent


✓ Clarity of purpose


✓ Active consent



✓ Power to withdraw

GDPR gives data subjects the right to withdraw their consent at any time. Without consent, organisations cannot use the data of such individuals for any processing.

Better control over how data is processed

Residents of the EU states are going to enjoy a lot more control over who collects their data and how they process it. This GDPR summary indicates how the rights of the EU residents are all set to experience a significant boost by the implementation of the General Data Protection Regulation (GDPR).

✓ Improved access


✓ Exercising objection



✓ Data portability


Which organisations come under their purview?


There’s more!

Organisations that do not operate within the EU, but do collect, store, or process the data of the EU residents, also come under GDPR. Even third-party organisations that work for companies offering goods and services to EU residents come under the purview of GDPR. That is a large group of industries and businesses that are affected by GDPR, and that is why it has created so many ripples across the business world.

GDPR Summary

What principles do these organisations have to follow?

General Data Protection Regulation (GDPR) has enlisted 6 data protection principles in Article 5. All the organisations within the EU or those outside of the EU that deal with the personal data of EU residents are required to process the personal data according to these 6 GDPR data protection principles.

✓ Principle 1: Fair & Legal Practice


✓ Principle 2: Limitation of Purpose


✓ Principle 3: Data minimisation

The reason for the data collection stated by the organisation specifies the need and relevance of the data collected.

✓ Principle 4: Maintaining Accuracy

Organisations are responsible for maintaining the accuracy of the data collected by them. They are also required to erase the data of questionable accuracy or update it without any undue delay.

✓ Principle 5: Limit Storage


✓ Principle 6: Secure the Data


How can the organisations ensure compliance with GDPR?


✓ Review Security



✓ Record Keeping


✓ Creating Flexible Systems


✓ Updated Consents

Organisations should ensure that they have updated consent for all the data they are storing and processing. The GDPR summary has already mentioned how consent forms should look like. If they do not have the required consent, then they should have a strategy in place to request, record, and refresh the consent of their data subjects.


✓ Ensuring Encryption of Data



✓ Data Protection Impact Assessment (DPIA)

Organisations which process data that “is likely to result in a high risk to the rights and freedoms of natural persons” is mandated to conduct a Data Protection Impact Assessment (DPIA). These include organisations that extensively analyse personal data which may have legal or other significant implications, organisations that participate in the large-scale monitoring of public areas, and so on.

✓ Data Protection Officer (DPO)


The General Data Protection Regulation (GDPR) is a set of regulations applicable to the European Union. This law provides a framework for data protection and privacy in the European Union and the European Economic Area. 

This framework provides an outline of 7 key principles on the provision of privacy and data security in the digital nuanced world. According to the GDPR, all individuals have a right to decide whether they want to share their information with another business or not. The information may range from the basic contact details, medical and criminal history, sexual and gender-based information as well as any genetic, or behavioural data. There may be the use of such sensitive data in today’s market and product research. 

It also looks over the processing, transfer and exchange of personal data outside the EU and EEA areas. 

Processing entails:

  • the collection, organisation, structuring, storage of data 
  • the alteration, consultation, use, communication, a combination of data 
  • and the restriction, erasure or destruction of personal data.

The GDPR is based on seven key principles for processing data lawfully. The safeguarding of the 7 principles is essential for the lawful processing of personal data.

What happens if organisations do not comply?

General Data Protection Regulation (GDPR) is a big step towards strengthening data privacy. To ascertain that GDPR meets its intended objectives, it is essential that there is a strong deterrent to non-compliance. And the deterrent it is! This GDPR summary captures how the policymakers have ensured that the cost of non-compliance with the new data privacy law is prohibitively high.

✓ Financial Loss



✓ Loss of brand value


General Data Protection Regulation (GDPR) is a data protection regulation that sets a precedent for data privacy laws across the globe. After all, it is one of the most stringent and far-reaching data protection laws in the world. To comply with such a strict law, organisations have to unlearn old data practices to save themselves from hefty fines, loss of reputation and business.
