What Is GDPR?

The General Data Protection Regulation (GDPR) is a comprehensive data protection law enacted by the European Union, in force since May 25, 2018. It governs how organizations collect, store, process, and share personal data of individuals in the EU and European Economic Area (EEA). GDPR applies regardless of where the organization is based — if you process personal data of people in the EU while offering them goods or services or monitoring their behavior, GDPR very likely applies to you.

For founders and compliance leads, GDPR matters for three practical reasons. First, it is a legal requirement with real teeth: fines can reach 20 million euros or 4 percent of global annual revenue, whichever is higher. Second, it is a commercial gatekeeper — EU enterprise customers will not sign with a vendor that cannot demonstrate GDPR compliance, and their procurement teams will ask for your Data Processing Agreement, sub-processor list, and transfer mechanisms before a deal closes. Third, it is the template that most other privacy laws copy, so the work you do for GDPR carries over to the UK GDPR, Brazil's LGPD, and the growing family of US state laws.

This lesson gives you the working mental model: what the regulation actually regulates, the seven principles everything hangs on, who it applies to, and what enforcement looks like in practice.

What GDPR Actually Regulates

GDPR regulates the processing of personal data. Both words are defined broadly, and the breadth is the point.

Personal data (Article 4) is any information relating to an identified or identifiable natural person — the "data subject." This obviously includes names, email addresses, and phone numbers. It also includes IP addresses, device identifiers, cookie IDs, location data, employee records, CVs, support tickets, call recordings, and inferences you draw about people (a "likely to churn" score attached to a user is personal data). If information can be linked to a person directly or indirectly, it is personal data. Truly anonymized data — where re-identification is no longer reasonably possible — falls outside GDPR, but the bar for genuine anonymization is high; pseudonymized data (for example, records keyed by a user ID) is still personal data.

Special category data (Article 9) gets extra protection: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and data concerning sex life or sexual orientation. Processing these requires both an Article 6 lawful basis and a separate Article 9 condition, such as explicit consent.

Processing is essentially anything you do with data: collecting, recording, storing, structuring, using, disclosing, combining, or deleting it. Simply holding data in a database is processing.

The Seven Principles (Article 5)

Every GDPR obligation traces back to seven principles. When regulators investigate, they frame findings in terms of these principles, so they are worth internalizing rather than skimming.

1. Lawfulness, fairness, and transparency. You need a valid lawful basis for every processing activity (covered in depth in the lawful basis lesson), you must not process data in ways people would find deceptive or unexpected, and you must tell people what you are doing — usually via a privacy notice.

2. Purpose limitation. Collect data for specified, explicit, legitimate purposes and do not reuse it for incompatible ones. Data collected to deliver your product cannot be quietly repurposed for an unrelated venture — training a new model on customer content, for instance, needs its own analysis.

3. Data minimization. Collect only what is adequate, relevant, and necessary. "We might want it someday" is not a purpose. Long signup forms, catch-all analytics, and hoarded logs all create minimization risk.

4. Accuracy. Keep data accurate and up to date, and correct or erase inaccurate data without delay. This pairs with the data subject's right to rectification.

5. Storage limitation. Keep data in identifiable form only as long as necessary for the purpose. In practice, this means a retention schedule and actual deletion jobs — not a policy document that no system enforces.

6. Integrity and confidentiality. Apply appropriate technical and organizational security: encryption, access control, resilience, and testing. Article 32 elaborates this into concrete security expectations.

7. Accountability. You must be able to demonstrate compliance with the other six. This is why GDPR programs generate artifacts: records of processing activities (ROPA), DPIAs, policies, DPAs, and training records. Under GDPR, undocumented compliance is treated as no compliance.

Who GDPR Applies To (Article 3)

GDPR has two hooks for territorial scope:

• Establishment. If you have an establishment in the EU (an office, a subsidiary, even a single stable representative) and process personal data in the context of its activities, GDPR applies — even if the data subjects are outside the EU.
• Targeting. If you are outside the EU but offer goods or services to people in the EU (even free ones) or monitor their behavior (analytics, tracking, profiling), GDPR applies to that processing.

A US SaaS company with EU customers must comply. A US company that accepts EU signups, prices in euros, or runs behavioral analytics on EU visitors is in scope. Non-EU companies caught by the targeting test generally must also appoint an EU representative under Article 27 — a frequently missed requirement.

Note that GDPR protects people in the EU/EEA, not EU citizens abroad. An EU citizen living in Texas using your US product is not covered by that fact alone; a Brazilian resident living in Berlin is.

Controllers and Processors

GDPR assigns obligations by role, and getting your role right shapes your entire compliance program.

• A controller determines the purposes and means of processing — the "why" and "how." Your company is a controller for its own customer, marketing, and employee data.
• A processor processes personal data on behalf of a controller, under its instructions. A SaaS vendor is typically a processor for the data its customers load into the product — while remaining a controller for its own account, billing, and product analytics data. Most B2B companies wear both hats simultaneously.
• Article 28 requires a written Data Processing Agreement (DPA) between controller and processor, covering instructions, confidentiality, security, sub-processors, assistance with data subject rights, breach notification, and deletion or return of data at contract end.

Enforcement and Penalties

Each EU member state has a supervisory authority (the CNIL in France, the Irish DPC, Germany's state authorities, and so on), coordinated through the European Data Protection Board (EDPB). For companies operating across the EU, the "one-stop-shop" mechanism usually routes enforcement through the authority of your main EU establishment — which is why so many major tech cases run through Ireland.

Fines come in two tiers: up to 10 million euros or 2 percent of global annual turnover for infringements like inadequate security or missing records, and up to 20 million euros or 4 percent of global turnover for violations of the principles, lawful basis rules, data subject rights, or transfer rules. Enforcement has been sustained and substantial: cumulative GDPR fines have run into the billions of euros, with the largest individual penalties exceeding a billion euros for unlawful transfers and consent failures. Regulators also fine small companies — the median enforcement action is far smaller than the headlines, but very real for a startup.

Beyond fines, authorities can order processing bans (arguably worse than a fine if it halts your product), and individuals can sue for damages and lodge complaints — a single unhappy user email to a regulator is a common trigger for investigation.

What a GDPR Program Actually Involves

Compliance is not a document; it is a set of operating capabilities:

• A data map / ROPA covering what personal data you hold, why, where, and with whom you share it
• A documented lawful basis per processing activity (next-level detail here)
• A public privacy notice meeting Articles 13–14
• Processes to honor data subject rights within one month (covered in the next lesson)
• DPAs with all processors and a maintained sub-processor list
• Security controls proportionate to risk, plus a tested breach response process meeting the 72-hour notification rule
• DPIAs for high-risk processing, a decision (documented) on whether you need a DPO (see the DPO lesson), and lawful transfer mechanisms for data leaving the EEA (transfers lesson)

GDPR Applicability Checklist

Use this to decide whether — and how — GDPR applies to you:

• Do you have any office, subsidiary, or stable presence in the EU/EEA?
• Do you offer products or services (paid or free) to people in the EU?
• Do you monitor behavior of people in the EU (analytics, ads, tracking, profiling)?
• Do EU-based customers upload their users' personal data into your product (making you a processor)?
• Have you identified every category of personal data you process, including logs, support data, and inferences?
• Do you process any special category data (health, biometrics, etc.)?
• If in scope with no EU establishment, have you appointed an Article 27 EU representative?
• Have you determined your role (controller, processor, or both) for each data set?
• Can you demonstrate compliance with documentation — ROPA, notices, DPAs, policies?

If you checked any of the first four boxes, plan on a real GDPR program, scaled to your risk.

Frequently Asked Questions

Does GDPR apply to small businesses and startups?

Yes. There is no revenue or headcount threshold for GDPR applying — a two-person startup processing EU personal data is covered. The only meaningful small-organization carve-out is a partial exemption from Article 30 record-keeping for organizations under 250 employees, and it does not apply if processing is non-occasional (which almost all product data processing is). Scale affects how much program you need, not whether the law applies.

Is an IP address really personal data?

Generally yes. Regulators and the Court of Justice of the EU treat IP addresses, cookie IDs, and device identifiers as personal data because they can single out an individual, especially combined with other data. Build your analytics and logging practices on that assumption.

What is the difference between GDPR and the UK GDPR?

After Brexit, the UK retained a nearly identical law — the UK GDPR plus the Data Protection Act 2018 — enforced by the ICO. If you serve both markets, you comply with two parallel regimes; the substance overlaps heavily, but transfers, representatives, and lead-authority questions must be handled separately for each.

Do I need consent for everything under GDPR?

No — this is the most common misconception. Consent is one of six lawful bases, and often the worst choice because it can be withdrawn at any time. Most SaaS processing runs on contractual necessity or legitimate interests. Where consent is required — notably for non-essential cookies under the ePrivacy rules and for marketing — it must meet a high standard: freely given, specific, informed, and unambiguous.

Can GDPR fines really hit a company outside the EU?

Yes. Supervisory authorities have fined non-EU companies, and enforcement can proceed through EU representatives, EU-based revenue, partners, and market access. Practically, the bigger lever for most non-EU vendors is commercial: EU customers simply will not buy from a non-compliant vendor.

Is certification like ISO 27001 or SOC 2 the same as GDPR compliance?

No. Security certifications cover part of the integrity-and-confidentiality principle, but say nothing about lawful basis, transparency, rights handling, or transfers. They are complementary evidence, not substitutes. GDPR does contemplate approved certification schemes (Article 42), and Europrivacy is one such approved mechanism, but adoption is still limited.

In the next lesson, we will cover data subject rights — the eight rights individuals can exercise against you and how to build a request-handling process that meets the one-month deadline.

Building a GDPR program usually means choosing privacy and GRC tooling, and often an auditor or certification partner. AuditXYZ helps you compare compliance automation platforms and find auditors — features, framework coverage, and pricing in one place.