FinTech Glossary

What Is GDPR

GDPR, or the General Data Protection Regulation, is a data protection and privacy law enacted by the European Union. It governs how organisations collect, process, store, and protect personal data of individuals located in the EU and EEA, regardless of where the organisation itself is based.

Purpose of GDPR

The primary purpose of GDPR is to give individuals greater control over their personal data and to ensure organisations handle that data responsibly.

It establishes clear rules around transparency, consent, security, and accountability in data processing.

GDPR also aims to create a consistent data protection framework across EU member states.

Who Does GDPR Apply To

GDPR applies to any organisation that processes personal data of EU or EEA residents.

This includes companies based outside the EU if they offer goods or services to individuals in the EU or monitor their behaviour.

The regulation applies to businesses, public bodies, non-profits, and digital platforms that handle personal data.

GDPR Compliance Requirements

To comply with GDPR, organisations typically need to:

1. Obtain valid consent for data processing
2. Maintain clear privacy notices
3. Implement data security measures
4. Keep records of data processing activities
5. Report data breaches within required timelines
6. Appoint a Data Protection Officer when applicable

Non-compliance can result in significant penalties.