What Is GDPR? Complete Guide to EU Data Protection (2026)

The General Data Protection Regulation, known as the GDPR, is the most comprehensive data privacy law in the world. Adopted by the European Union as Regulation (EU) 2016/679, it governs how organizations collect, store, process, and share the personal data of individuals located in the European Union and European Economic Area.

The European Parliament passed the GDPR on April 14, 2016. After a two-year transition period, it took effect on May 25, 2018, replacing the outdated 1995 Data Protection Directive. Every EU member state enforces the GDPR through a national supervisory authority, coordinated at the EU level by the European Data Protection Board (EDPB).

This guide covers the full GDPR framework: its history, territorial scope, seven core principles, key definitions, enforcement structure, and global influence. For related topics, see our guides to GDPR compliance, GDPR fines, and data subject rights.

This article is for informational purposes only and does not constitute legal advice. Consult a qualified data protection attorney or privacy professional for guidance specific to your situation.

History of the GDPR

The GDPR did not appear out of nowhere. It grew from decades of European data protection law, driven by technological change and the explosion of personal data on the internet.

The 1995 Data Protection Directive

The EU's first comprehensive data protection law was Directive 95/46/EC, adopted in 1995. That directive established basic principles for data processing and required each EU member state to pass its own national implementing law.

The directive worked reasonably well for its time, but it created a patchwork of 28 different national laws. Businesses operating across Europe had to comply with different rules in each country. By the early 2010s, the rise of social media, cloud computing, and smartphone apps had made the 1995 framework deeply inadequate.

The Path to GDPR Adoption

The European Commission proposed the GDPR in January 2012 as a regulation rather than a directive. A regulation applies directly in every member state without national implementing legislation, eliminating the patchwork problem.

Negotiations between the European Parliament, Council of the European Union, and European Commission lasted four years. The European Data Protection Supervisor (EDPS) documented that the process involved more than 3,000 amendments during the parliamentary debate stage alone.

The Council adopted its position on April 8, 2016. The European Parliament approved the final text on April 14, 2016. The regulation was published in the Official Journal on May 4, 2016, with a two-year implementation window before taking effect on May 25, 2018.

Post-Enforcement Developments

Since 2018, the GDPR has continued to evolve through enforcement actions, court rulings, and regulatory guidance. The EDPB has published dozens of guidelines interpreting specific GDPR provisions, and courts across Europe have issued landmark rulings on topics from consent to international data transfers.

In May 2025, the EU adopted the GDPR Procedural Regulation, which introduced fixed deadlines for cross-border enforcement decisions and streamlined cooperation between national supervisory authorities.

Who Does the GDPR Apply To? Territorial Scope (Article 3)

The GDPR has one of the broadest territorial reaches of any law in history. Article 3 establishes three scenarios where the regulation applies.

EU-Based Organizations

The GDPR applies to any organization that processes personal data in the context of an establishment in the EU, regardless of whether the actual processing takes place within Europe. A company headquartered in Berlin that processes data on servers in the United States is still subject to the GDPR.

Non-EU Organizations Targeting EU Individuals

Organizations located outside the EU must comply with the GDPR if they offer goods or services to individuals in the EU. This means a US-based e-commerce store shipping to French customers, a Japanese app available in the German app store, or a Brazilian SaaS platform with EU subscribers all fall under the GDPR.

The EDPB Guidelines 3/2018 on territorial scope clarify that merely making a website accessible from the EU is not enough to trigger GDPR obligations. There must be evidence that the organization intends to offer goods or services to EU individuals, such as accepting euros, providing content in EU languages, or referencing EU customers.

Non-EU Organizations Monitoring EU Behavior

The GDPR also applies to organizations outside the EU that monitor the behavior of individuals located in the EU. Website analytics, behavioral advertising, location tracking, and cookie-based profiling all qualify as monitoring under this provision.

Non-EU Organizations Must Appoint a Representative

Under Article 27, non-EU organizations subject to the GDPR must designate a representative within the EU. This representative serves as a point of contact for supervisory authorities and data subjects.

The Seven GDPR Principles (Article 5)

Article 5 of the GDPR establishes seven principles that form the foundation of all data processing activities. Violating these principles carries the highest tier of fines.

1. Lawfulness, Fairness, and Transparency

Organizations must process personal data lawfully, fairly, and transparently. This means having a valid legal basis for every processing activity, using data in ways people would reasonably expect, and clearly communicating what happens to their data through accessible privacy notices.

2. Purpose Limitation

Personal data may only be collected for specified, explicit, and legitimate purposes. An organization that collects email addresses for order confirmations cannot later use those addresses for marketing unless it has a separate legal basis. Further processing for archiving, scientific research, or statistical purposes is permitted under certain safeguards.

3. Data Minimization

Organizations must collect only the personal data that is adequate, relevant, and limited to what is necessary. A food delivery app that asks for your date of birth, marital status, and political affiliations alongside your delivery address is violating this principle. Collect only what you need.

4. Accuracy

Personal data must be accurate and kept up to date. Organizations must take every reasonable step to erase or correct inaccurate data without delay. The ICO guidance on data protection principles notes that accuracy also means data should not be misleading in context.

5. Storage Limitation

Data must be kept in a form that permits identification of individuals for no longer than necessary. Once the purpose of processing is fulfilled, the organization must delete or anonymize the data. Retention policies must be documented, and organizations cannot hold personal data indefinitely "just in case."

6. Integrity and Confidentiality (Security)

Personal data must be processed with appropriate security measures. This includes protection against unauthorized access, accidental loss, destruction, or damage. Organizations must implement both technical measures (encryption, access controls, backups) and organizational measures (staff training, security policies, incident response procedures).

7. Accountability

The controller bears responsibility for demonstrating compliance with all six principles above. This is not a passive obligation. Organizations must maintain records, conduct assessments, implement policies, and be prepared to prove compliance to regulators at any time. The accountability principle shifted the burden from regulators having to prove a violation to organizations having to prove they are compliant.

Key GDPR Definitions

Understanding the GDPR requires familiarity with its core terminology. Article 4 contains 26 definitions. The most important ones follow.

Personal Data

Personal data means any information relating to an identified or identifiable natural person (called a "data subject"). This includes obvious identifiers like names and email addresses, but also IP addresses, cookie identifiers, location data, genetic data, biometric data, and any information that can directly or indirectly identify someone.

The European Commission emphasizes that the definition is technology-neutral. It applies whether data is stored digitally, captured through video surveillance, or written on paper.

Data Controller

A data controller is the natural or legal person, public authority, agency, or other body that determines the purposes and means of processing personal data. In plain language, the controller decides why and how personal data is processed. A retailer that collects customer addresses for shipping is the controller of that data.

Data Processor

A data processor is the entity that processes personal data on behalf of the controller. The processor does not decide what to do with the data; it follows the controller's instructions. A cloud hosting provider that stores customer data for a retailer is acting as a processor.

Controllers and processors have different obligations under the GDPR. Controllers bear primary responsibility for compliance, while processors must follow the controller's instructions and implement appropriate security measures. The EDPB Guidelines 07/2020 provide detailed guidance on how to determine which role an organization plays.

Data Protection Authority (Supervisory Authority)

Each EU member state has at least one independent supervisory authority responsible for monitoring GDPR compliance. These bodies have investigative powers (including audits and inspections), corrective powers (warnings, reprimands, and fines), and authorization powers (approving binding corporate rules and certifications).

Well-known supervisory authorities include Ireland's Data Protection Commission (DPC), France's Commission Nationale de l'Informatique et des Libertes (CNIL), and the UK's Information Commissioner's Office (ICO).

Data Protection Officer (DPO)

A Data Protection Officer is an independent expert appointed within an organization to oversee GDPR compliance. Under Articles 37 through 39, appointing a DPO is mandatory for public authorities, organizations whose core activities require large-scale systematic monitoring of individuals, and organizations that process special categories of data on a large scale.

Special Categories of Data

Article 9 identifies categories of personal data that receive extra protection: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (for identification), health data, and data about sex life or sexual orientation. Processing these categories is prohibited unless a specific exception applies.

Data Protection Impact Assessment (DPIA)

A DPIA is a formal assessment required under Article 35 before any processing that is likely to result in a high risk to individuals' rights and freedoms. It must describe the processing, assess necessity and proportionality, evaluate risks, and identify mitigation measures.

The Six Legal Bases for Processing (Article 6)

Under Article 6, processing personal data is lawful only if it falls under one of six legal bases. Organizations must identify and document their legal basis before processing begins.

Legal Basis	When It Applies	Common Example
Consent	Data subject gives clear, informed, unambiguous agreement	Newsletter signup with opt-in checkbox
Contractual Necessity	Processing needed to perform or prepare a contract	Shipping address for an online order
Legal Obligation	Required by law (tax, employment, anti-money laundering)	Employee payroll tax reporting
Vital Interests	Life-threatening situations	Medical emergency data sharing
Public Interest	Task in the public interest or official authority	Government health surveillance
Legitimate Interests	Controller's interest, balanced against individual rights	Fraud prevention, network security

For a deeper look at when consent is and is not required, see our guide to GDPR consent requirements.

Enforcement: How the GDPR Is Policed

The European Data Protection Board

The EDPB is the independent EU body that ensures consistent GDPR application across member states. It replaced the Article 29 Working Party when the GDPR took effect. The EDPB issues binding decisions in cross-border disputes, publishes guidelines interpreting GDPR provisions, and coordinates enforcement actions.

The One-Stop-Shop Mechanism

For organizations operating in multiple EU countries, the GDPR's one-stop-shop mechanism designates a single lead supervisory authority. The lead authority is typically the DPA in the country where the organization has its main EU establishment.

This mechanism prevents organizations from facing parallel investigations in multiple countries for the same processing. However, other concerned DPAs can raise objections, and the EDPB resolves disputes through binding decisions.

National DPAs in Action

Each national DPA operates independently within its jurisdiction. The most active by enforcement value include Ireland's DPC (which oversees Meta, Google, Apple, TikTok, and other tech giants with European headquarters in Dublin), France's CNIL, Italy's Garante, and Spain's AEPD.

Spain's AEPD leads in volume with over 1,000 individual fines issued, though most are smaller amounts targeting domestic companies. Ireland's DPC has issued the largest individual fines, including the record EUR 1.2 billion penalty against Meta in 2023.

For details on penalty amounts and how fines are calculated, see our guide to GDPR fines and penalties.

How the GDPR Changed Privacy Globally

The GDPR did not just change European law. It reshaped data privacy expectations worldwide.

The Brussels Effect

Legal scholars call this phenomenon the "Brussels Effect." Because the GDPR applies to any organization processing EU residents' data, companies worldwide had to upgrade their privacy practices. Many chose to apply GDPR-level protections globally rather than maintain separate systems for EU and non-EU users.

Laws Inspired by the GDPR

Dozens of countries have enacted or updated privacy laws modeled on the GDPR. Brazil's Lei Geral de Protecao de Dados (LGPD) took effect in 2020 and mirrors many GDPR provisions. Japan amended its Act on Protection of Personal Information (APPI) to align with GDPR standards, earning an adequacy decision from the European Commission. South Korea's Personal Information Protection Act (PIPA) and India's Digital Personal Data Protection Act of 2023 both drew heavily from the GDPR model.

In the United States, state-level privacy laws like the California Consumer Privacy Act (CCPA) and its successor the California Privacy Rights Act (CPRA) incorporate GDPR concepts such as data subject rights, purpose limitation, and data minimization.

Adequacy Decisions as Global Standards

The European Commission's adequacy framework effectively sets a global benchmark. Countries seeking adequacy status must demonstrate data protection standards "essentially equivalent" to the GDPR. As of early 2026, 17 countries and territories have received adequacy decisions, with Brazil being the most recent addition in January 2026.

GDPR and Related EU Regulations

The GDPR does not operate in isolation. It is part of a broader EU digital regulation framework.

ePrivacy Directive (Cookie Law)

The ePrivacy Directive (Directive 2002/58/EC) complements the GDPR by governing electronic communications, including cookie consent requirements. A proposed ePrivacy Regulation to replace the directive has been under negotiation since 2017.

Other EU Digital Laws

The Digital Services Act (DSA), Digital Markets Act (DMA), and EU AI Act all intersect with GDPR obligations. Organizations subject to these laws must comply with both the sector-specific rules and the GDPR's general data protection requirements.

More GDPR and Data Privacy Guides

Explore our detailed guides on specific GDPR topics:

• GDPR Compliance Checklist for a step-by-step compliance guide
• GDPR Fines and Penalties for enforcement data and the largest fines to date
• GDPR Data Subject Rights for all eight individual rights
• GDPR Consent Requirements for valid consent standards
• GDPR Breach Notification 72-Hour Rule for breach reporting obligations
• GDPR for Small Businesses for SME-specific guidance
• EU Data Privacy Laws for the complete EU data protection overview