Top.Mail.Ru
GDPR (General Data Protection Regulation) — Postmypost
Log in
Sign up
RU EN
Log in Sign up
Glossary – GDPR (General Data Protection Regulation)

GDPR (General Data Protection Regulation)

Nikiforov Alexander
Friend of clients
Back

Contents

Introduction to GDPR

GDPR, or General Data Protection Regulation, is a legislative act that defines the rules for the collection, processing, storage, and distribution of personal data within the European Union. The regulation came into effect on May 25, 2018, replacing the "Directive 95/46/EC," which had been in force since October 24, 1995. All EU member states are required to comply with its provisions, making it an important tool for protecting human rights in the digital age.

GDPR covers any type of interaction between organizations and EU citizens where personal data is used. Such data includes information that can identify an individual, including names, addresses, phone numbers, as well as online identifiers such as IP addresses and cookies.

Main Objectives of GDPR

The main task of GDPR is to protect personal data and prevent violations of human rights. The regulation provides EU citizens with enhanced rights, allowing them to request information about how their data is processed, as well as demanding its deletion or transfer to another operator. It is important to note that users can opt out of the processing of their data for purposes unrelated to the original request.

Under GDPR, every organization must develop a Privacy Policy that clearly reflects users' rights and the methods by which their information is processed. Aligning this policy with GDPR standards becomes a mandatory step for companies working with the personal data of EU citizens.

Participants in Data Processing under GDPR

According to the regulation, the key participants in data processing are:

  • Controller: this is a company or individual who determines the purposes and means of processing data and is responsible for complying with GDPR requirements.
  • Processor: this is an individual or organization that processes data on behalf of the controller. They are subordinate to the controller and act within the established processing objectives.

Additionally, many companies that handle large volumes of data hire designated Data Protection Officers (DPOs) who are responsible for ensuring compliance with GDPR and liaising with supervisory authorities.

Principles of Data Processing

GDPR includes a number of principles that must be adhered to when processing personal data. These principles serve as key guidelines for controllers and processors:

  • Lawfulness, fairness, and transparency: data must be processed lawfully and in a transparent manner.
  • Purpose limitation: information is collected for a specific, legitimate purpose and processed accordingly.
  • Data minimization: data collection should be limited to only what is necessary.
  • Accuracy: inaccurate data must be corrected or deleted without delay.
  • Storage limitation: data should not be retained longer than necessary for the purposes of processing.
  • Integrity and confidentiality: data security must be ensured, protecting it from breaches.

GDPR Requirements

To comply with GDPR requirements, organizations must meet the following conditions:

  • Collect and use personal data only with the owner's consent, which must be clear and unequivocal.
  • Process data only for established purposes.
  • Delete information immediately after the purposes of processing have been met.
  • Delete data promptly upon the owner's request.
  • Appoint a data protection officer who must be competent in GDPR matters.
  • Maintain documentation demonstrating compliance with GDPR standards.

Who Must Comply with GDPR

Compliance with GDPR is mandatory for all organizations registered in the EU, as well as for any companies offering goods or services to EU citizens. This applies not only to large firms but also to small and medium-sized enterprises that interact with EU citizens online.

It is important to note that GDPR compliance is not required for personal activities, nor for organizations with fewer than 250 employees, unless they process data on a large scale.

Penalties for Non-Compliance with GDPR Rules

Violations of GDPR standards can lead to serious consequences, including financial penalties. Supervisory authorities have the right to verify compliance with the regulation and impose fines that may reach:

  • Up to 10 million euros or 2% of annual revenue for controller obligations non-compliance.
  • Up to 20 million euros or 4% of annual revenue for violations of data processing principles.

Fines are calculated based on the severity of the violation, its duration, and other factors. It is important to remember that compliance with GDPR not only helps avoid fines but also builds trust between companies and their clients.