What is the GDPR?

The General Data Protection Regulation (GDPR) is a European Union regulation that regulates the processing of personal data of EU citizens. The GDPR came into force in May 2018 and applies to all businesses that process personal data of EU citizens, regardless of their location.

Why is the GDPR important?

The GDPR is important because it protects the rights of EU citizens with regard to their personal data. The GDPR establishes a set of principles and requirements that businesses must comply with to ensure the protection of personal data, including:

  • Transparency principle: Businesses must inform citizens about the processing of their personal data.
  • Consent principle: Businesses may only process personal data with the consent of the data subject.
  • Data minimization principle: Businesses may only process the personal data necessary for the intended purpose.
  • Storage limitation principle: Businesses may only retain personal data for as long as necessary for the intended purpose.
  • Security principle: Businesses must implement technical and organizational measures to protect personal data.
  • Portability principle: Citizens have the right to obtain a copy of their personal data in a structured, commonly used and machine-readable format.

Privacy risks without the GDPR

If the GDPR did not exist, businesses could process the personal data of EU citizens without their consent and without respecting their rights. This could lead to a number of privacy risks, including:

  • Identification and tracking: Businesses could use personal data to identify and track citizens.
  • Discrimination: Businesses could use personal data to discriminate against citizens.
  • Identity theft: Personal data could be used to steal the identity of citizens.
  • Harassment: Personal data could be used to harass citizens.

Conclusion

The GDPR is an important regulation that protects the rights of EU citizens with regard to their personal data. If the GDPR did not exist, citizens would be exposed to a number of privacy risks.

Posts

Frequency detectors in exams: an invigilator sweeps the room with a detector while a student wears an earpiece

Frequency detectors in exams: they cheat with AI, and catching them has rules too

Frequency detectors in exams are lawful when they are passive, but the risk is not the device — it is how it is used. The law, the privacy limits and a six-step protocol.
Fingerprint time tracking reader at a company entrance

Fingerprint time tracking in 2026: annulling the AEPD guidance did not make it legal

Spain's National Court annulled the AEPD biometrics guidance in June 2026. The instrument fell, not the rule: what your company must prove before keeping a fingerprint reader.
Twitter metadata and anonymisation concept illustrating privacy risks for users.

Twitter metadata is a privacy nightmare

Twitter/X metadata can reveal behavioural patterns and identify users even when the content of a post appears anonymous.
Data Processing Agreement under GDPR explained visually with controller, processor, security and personal data protection.

Data Processing Agreement under GDPR: when it is required and what it must include

Learn when a Data Processing Agreement is required under GDPR, what clauses it must include, and how to review processors, subprocessors, security, AI and international transfers.

Special Categories of Data Under the GDPR: Practical Guide

Practical guide to special categories of data under the GDPR: health, biometric, political, religious and sexual orientation data, Article 9 exceptions and safeguards.
Hombre con camisa blanca hablando por el teléfono móvil en la calle

Is the end of spam calls?

What does the General Telecommunications Law ("LGT") say about "spam" calls? Is the end of spam calls? The General Communications Law ("LGT") was published on 28 June 2022. In its article 66.1.b) it mentions that end users of interpersonal…
Salón de una vivienda con el testigo rojo de grabación REC en la pared

Property agency fined for exposing images of minors

The fine imposed on a property agency for exposing images of minors has highlighted the importance of protecting the rights of minors. An individual filed a complaint with the Spanish Data Protection Agency, with the aim of highlighting the…

Face recognition in exams: Is it proportionate?

The Catalan Data Protection Authority (Autoritat Catalana de Protecció de Dades) has sanctioned the Universitat Oberta de Catalunya for collecting biometric data from its students through face recognition, in order to verify that they were…
multa a orange por fotografiar DNI de sus clientes

Photographing Customer ID Documents: GDPR Risks and Data Minimisation

Why photographing or copying customer ID documents may breach the GDPR and what less intrusive alternatives companies should assess.

Transborder data transfers

The scope of transborder data transfers The publication of the General Data Protection Regulation (GDPR) on May 25, 2016 in the European Union, served as inspiration worldwide for the implementation of data privacy laws. Many countries,…
FUTBOL

Sanction for recording underage soccer match

In procedure PS/00313/2021, the Spanish Data Protection Agency (AEPD) has imposed a fine of €3,000 on a company specialized in recording soccer matches for capturing images of minors without prior consent from their parents. Sanction for…

Lack of information on the processing of personal data

The AEPD imposes penalties to real estate companies of up to 5,000 € for not informing the interested party of the processing of their personal data. Several affected parties have filed complaints to the AEPD, in relation to the use of their…

Microsoft 365 in Schools: Privacy, Cloud Services and GDPR Lessons

Lessons from the Microsoft 365 schools debate: cloud platforms, minors, contracts, international transfers and GDPR compliance.
Digital Markets Act DMA obligations for gatekeepers and core platform services in the EU.

Digital Markets Act DMA: key obligations

The Digital Markets Act DMA regulates gatekeepers and core platform services. Key obligations and practical effects for digital businesses in the EU.
Digital Services Act DSA obligations for online platforms and intermediary services in the EU.

Digital Services Act DSA: key obligations

The Digital Services Act DSA is now applicable, setting obligations for online platforms, marketplaces, search engines and intermediary services in the EU.