EU General Data Protection Regulation

Understand the GDPR — in plain English.

The clearest guide to Europe's data-protection law: the key changes, every article explained, FAQs, the latest enforcement — and data-protection lawyers when you need to act.

99
Articles in the Regulation
€20M
or 4% of global turnover — max fine
27
EU member states covered
2018
Enforceable since 25 May
Overview

What is the GDPR?

The EU General Data Protection Regulation is the most important change in data-privacy law in two decades.

The GDPR replaced the 1995 Data Protection Directive to harmonise privacy law across Europe, give individuals real control over their personal data, and reshape how organisations everywhere handle it.

Approved in April 2016, it became enforceable on 25 May 2018. It applies to any organisation — anywhere in the world — that processes the personal data of people in the EU.

Watch: GDPR explained in plain English

Video
For individuals

Your rights, at a glance

The GDPR gives every person in the EU enforceable rights over their personal data.

Right to access

Obtain confirmation and a free copy of the personal data held about you.

Right to rectification

Have inaccurate or incomplete personal data corrected without delay.

Right to erasure

The 'right to be forgotten' — have your data deleted in defined cases.

Data portability

Receive your data in a machine-readable format and move it elsewhere.

Right to object

Object to processing, including profiling and direct marketing.

Restrict processing

Limit how your data is used while a concern is investigated.

See how each right works

Have a data-protection question?

Whether you are mapping data, facing a request, or responding to a breach — tell us what you need and we'll point you to the right specialist.