GDPR (General Data Protection Regulation)

The General Data Protection Regulation – more commonly referred to as GDPR – applies to all organisations worldwide that process personal data of European Union (EU) citizens, effectively making it the first global data protection law. Its introduction is based on the fact that many businesses and services operate across borders, making international consistency around data protection laws and rights crucial both to organisations and individual alike. The growing digital economy also makes it important for safeguards to be in place regarding data, and the individuals to whom it applies.

If your organisation falls under the description above, it is under a legal obligation to comply with GDPR. The GDPR places greater emphasis on the documentation that data controllers must keep to demonstrate their accountability. Compliance with all the key areas will require your organisation to review its approach to governance and how it manages data protection as a corporate issue. One aspect of this might be to review the contracts and other arrangements you have in place when sharing data with other organisations.

This overview highlights the GDPR’s key themes to help you understand the legal framework in the EU. It is for those who have day-to-day responsibility for data protection.

Who does the GDPR apply to?

  • The GDPR applies to ‘controllers’ and ‘processors’. The controller says how and why personal data is processed and the processor acts on the controller’s behalf.

What information does the GDPR apply to?

Personal data

The GDPR applies to ‘personal data’. However, the GDPR’s definition is more detailed and makes it clear that information such as an online identifier – eg an IP address – can constitute personal data. The more expansive definition provides for a wide range of personal identifiers to constitute personal data, reflecting changes in technology and the way organisations collect information about people.




Sensitive personal data




Jargon Buster

A Glossary of terms used in this article:

IP address

Internet Protocol address: a unique address that is used to identify a computer or mobile device on the internet.