What is GDPR? - Definition & Meaning
GDPR is the European privacy law that regulates how organizations may collect and process personal data. Learn what GDPR entails.
Definition
GDPR (General Data Protection Regulation) is a European regulation that protects the rights of individuals regarding their personal data. Since May 25, 2018, the law sets strict requirements on how organizations collect, process, store, and share personal data.
Technical Explanation
GDPR defines core principles such as lawfulness, purpose limitation, data minimization, accuracy, storage limitation, and integrity/confidentiality. Organizations must have a legal basis for processing (consent, contract, legal obligation, legitimate interest). Technical requirements include data protection by design and by default, Data Protection Impact Assessments (DPIAs), data processing agreements, and maintaining a processing register. Fines can reach up to €20 million or 4% of global annual revenue. Data subjects have rights including access, rectification, erasure (right to be forgotten), and data portability.
How Refront Uses This
Refront is designed with GDPR compliance as a foundation. Personal data is stored encrypted, access is restricted via role-based access control, and all data processing is logged in an audit trail. Clients can use the platform to meet their obligations toward their own customers, including data export and deletion requests.
Examples
- •Refront provides a data export function so organizations can comply with their customers' right to data portability.
- •When onboarding a new client, a data processing agreement is automatically generated and digitally signed.
- •The audit trail logs every access to personal data, so during a regulatory audit it can be shown exactly who viewed what.
Frequently Asked Questions
Does GDPR apply to small businesses?
Yes, GDPR applies to every organization that processes personal data of EU residents, regardless of size. Small businesses do have some exemptions, such as not being required to appoint a Data Protection Officer under certain conditions.
What counts as personal data under GDPR?
Any information that can be directly or indirectly linked to an identifiable person: name, email address, IP address, location data, national ID numbers, as well as online identifiers like cookies and device IDs.
What are the fines for GDPR violations?
There are two fine tiers: up to €10 million or 2% of annual revenue for less serious violations, and up to €20 million or 4% of annual revenue for serious violations. Supervisory authorities use guidelines to determine the fine amount.
Ready to get started?
Try Refront for free and discover how AI automates your workflow.