What Is GDPR?

The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection law, applicable since 25 May 2018 (Regulation (EU) 2016/679). It governs how organizations collect, store, use, and share the personal data of people in the EU - and gives those people enforceable rights over their own data. The GDPR applies extraterritorially: it covers organizations established in the EU and, under Article 3(2), organizations elsewhere that offer goods or services to, or monitor the behavior of, people in the EU, which is why it became an international reference point for data privacy.

GDPR matters because it changed data protection from a compliance footnote into a board-level obligation with real teeth - fines of up to €20 million or 4% of worldwide annual turnover. But beyond the penalties, it reframed personal data as something organizations hold in trust rather than own outright. Its lasting operational consequence is simple: you cannot protect, justify, or delete personal data you cannot find, classify, and trace - which makes GDPR, underneath the legal language, a data governance problem.

GDPR Defined

The GDPR is a regulation - directly applicable in every EU Member State without national transposition, and extended to Iceland, Liechtenstein, and Norway through the EEA Agreement. It protects "personal data," defined broadly as any information relating to an identified or identifiable living person, and regulates its "processing" - essentially any operation performed on that data, from collection to deletion. Its scope is deliberately wide: a name, an email, an IP address, a location, or an online identifier can all be personal data.

Its defining characteristics:

• Rights-based - It centers on the rights of the individual (the "data subject"), not just the obligations of organizations.
• Principle-led - Compliance flows from seven high-level principles rather than a checklist of narrow rules.
• Extraterritorial - It also reaches organizations outside the EU that offer goods or services to, or monitor, people in the EU.
• Accountability-driven - Organizations must not only comply but be able to demonstrate compliance with documented evidence.

The Seven Principles

Article 5 sets out seven principles that underpin everything else in the regulation. Every processing activity must satisfy all of them.

1. Lawfulness, fairness & transparency. Process data legally, fairly, and in a way people can understand.
2. Purpose limitation. Collect data for specified, explicit purposes and don't repurpose it incompatibly.
3. Data minimisation. Collect only what you actually need.
4. Accuracy. Keep data correct and up to date.
5. Storage limitation. Don't keep data longer than necessary.
6. Integrity & confidentiality. Secure data against unauthorized access, loss, or damage.
7. Accountability. Be able to demonstrate compliance with all of the above - the principle that turns the others into documented practice.

Data Subject Rights

The GDPR grants individuals a set of enforceable rights over their personal data, commonly grouped as eight (Articles 13-22). Honouring them is impossible without knowing exactly what personal data you hold and where:

• Right to be informed - about how their data is used.
• Right of access - to obtain a copy of their data (a "subject access request").
• Right to rectification - to correct inaccurate data.
• Right to erasure - the "right to be forgotten."
• Right to restrict processing - to pause use of their data.
• Right to data portability - to receive and reuse their data across services.
• Right to object - to certain processing, including direct marketing.
• Rights around automated decision-making - safeguards against solely automated decisions with significant effects.

The right to erasure and the right of access are the operational stress test: an organization that cannot locate every copy of a person's data across its systems cannot satisfy either. This is where lineage and a complete catalog stop being nice-to-haves.

Roles, Bases & Penalties

Lawful basis. Every processing activity needs at least one of the six lawful bases in Article 6: consent, contract, legal obligation, vital interests, public task, or legitimate interests. "We had the data" is never, by itself, a justification.

Roles. The GDPR assigns responsibility by role:

• Controller - decides why and how personal data is processed; carries primary accountability.
• Processor - processes data on the controller's behalf (e.g. a cloud vendor), under a contract.
• Data Protection Officer (DPO) - required for public authorities and for organizations whose core activities involve large-scale monitoring or large-scale processing of sensitive data (Article 37); monitors compliance and is the contact point for the supervisory authority.

Penalties & enforcement. Infringements carry fines up to €20 million or 4% of total worldwide annual turnover, whichever is higher; a lower tier of up to €10 million or 2% applies to infringements of certain organizational obligations, such as records, security, and breach notification. National supervisory authorities (DPAs) enforce the regulation, coordinated by the European Data Protection Board (EDPB), and personal data breaches must be notified to the supervisory authority without undue delay and, where feasible, within 72 hours, unless they are unlikely to result in a risk to people. The GDPR also constrains transfers of personal data outside the EU - the subject of data sovereignty.

GDPR & Data Governance

Strip away the legal vocabulary and GDPR compliance reduces to a set of capabilities that are pure data governance. You cannot minimise data you haven't inventoried, honour an erasure request without knowing every place a person's data lives, demonstrate accountability without documentation, or prove a lawful basis and purpose without documenting each processing activity. Each requirement maps directly onto a governance capability:

• A data catalog provides the inventory - what personal data exists and where - without which no other GDPR obligation can be met.
• Data classification identifies and tags personal and sensitive data so it can be protected and located on demand.
• Data lineage traces where personal data flows, which is what makes subject access, erasure, and breach impact analysis tractable.
• Data masking and access controls operationalize the integrity-and-confidentiality principle.
• Clear ownership assigns the accountability the regulation demands.

This is exactly the gap Dawiso fills for privacy teams: the catalog, classification, and lineage that turn GDPR's abstract obligations into things you can actually do and evidence. The DPO sets the policy; the governance platform is what lets the organization honour it. The same foundation also underpins the EU AI Act, DORA, and NIS2 - govern your data once, and you have the evidence base for several regimes at once.

Conclusion

GDPR turned personal data into a regulated asset held in trust, with rights for individuals and accountability for organizations. Eight years after it became applicable, its deepest lesson is operational rather than legal: compliance is downstream of governance. Organizations that know where their personal data lives, what it is, and where it flows meet GDPR almost as a by-product; those that don't face every subject access request and every audit as a fire drill. The regulation is the requirement - governed data is the answer.

Sources

The GDPR text is the primary source for every article reference above. gdpr-info.eu reproduces the official text article by article.

• Publications Office of the EU (EUR-Lex), Regulation (EU) 2016/679, General Data Protection Regulation (official text; dates in Article 99).
• GDPR Article 5, Principles relating to processing of personal data (the seven principles, accountability).
• GDPR Article 6, Lawfulness of processing (the six lawful bases).
• GDPR Chapter III, Rights of the data subject (Articles 12-23).
• GDPR Article 33, Notification of a personal data breach to the supervisory authority (the 72-hour rule).
• GDPR Article 83, General conditions for imposing administrative fines (the two fine tiers).
• European Data Protection Board, Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) (extraterritorial reach).