The General Data Protection Regulation, formally Regulation (EU) 2016/679, is the European Union's data protection and privacy regulation, adopted by the European Parliament and the Council of the European Union on 27 April 2016 and applicable across the EU from 25 May 2018. As a regulation rather than a directive it has direct legal effect in every member state with no national transposition law required. It requires that personal data be processed lawfully, fairly and transparently, collected for specified purposes, minimized to what is necessary, kept accurate, retained no longer than needed, and secured against unauthorized access, with organizations required to demonstrate compliance. It grants individuals enforceable rights including access to their data, erasure, and data portability, and it applies extraterritorially to any organization worldwide that processes the personal data of people located in the EU or offers them goods or services. Violations carry fines of up to twenty million euros or four percent of a company's global annual turnover, whichever is higher. It is widely regarded as the most consequential modern data protection regulation, having directly influenced comparable laws including Brazil's LGPD and the United States' California Consumer Privacy Act.
Facts
EraEuropean Union, adopted 27 April 2016, applicable from 25 May 2018 2 Promulgated ByThe European Parliament and the Council of the European Union 2 Jurisdiction ScopeThe European Union and European Economic Area, with extraterritorial effect on any organization worldwide that processes the personal data of people located there 2 Regulatory DomainPersonal data protection and privacy 2 Jurisdiction Scope
Jurisdiction Scope (category) Jurisdiction Scope (category) Classification
Legal Status Era
Era (category)21st Century (2000-Present) 3 Connections
Associated With
BDSG is Germany national implementing law supplementing the GDPR
Source General Data Protection Regulation (Wikipedia)
The Court of Justice of the European Union is the final interpreter of the Regulation. Its Schrems II ruling (Case C-311/18, 2020) invalidated the EU-US Privacy Shield transfer mechanism on the extraterritorial-transfer terms the Regulation itself sets, the clearest example of the Court shaping how the Regulation actually operates.
Pattern match: every other omnibus national/regional data protection statute already linked in this atlas carries associated-with to GDPR. Philippines DPA is the same class of comprehensive data protection law and was missing the link.
The Data Protection Act 2018 is UK domestic law that complements and implements the EU General Data Protection Regulation, the same pattern already live between the ePrivacy Directive and the GDPR.
Comparative privacy law regularly contrasts the United States sectoral approach exemplified by the Electronic Communications Privacy Act with the European Union's omnibus General Data Protection Regulation.
The ePrivacy Directive works alongside the General Data Protection Regulation to govern electronic communications privacy in the European Union.
Source EUR-Lex, Official Journal of the European Union
The revised Swiss data protection act was designed to align with the General Data Protection Regulation.
The Brazilian law was modeled closely on the General Data Protection Regulation.
the French law was amended in 2018 to align with GDPR requirements
Pattern match: every other omnibus national/regional data protection statute already linked in this atlas carries associated-with to GDPR. Singapore PDPA is the same class of comprehensive data protection law and was missing the link.
Sri Lanka's Personal Data Protection Act, No. 9 of 2022, is widely described in legal commentary as modeled on the General Data Protection Regulation.
The European Union recognized Canada's PIPEDA as providing adequate data protection partly on the strength of its alignment with GDPR-equivalent principles.
Source Personal Information Protection Law of the People's Republic of China (Wikipedia)
South Africa's Protection of Personal Information Act is widely described as modeled on the General Data Protection Regulation's principles and structure.
In Legal System
Applies EU-wide, and most EU member states are civil law jurisdictions; the United Kingdom, an EU member state when the GDPR took effect, retained a near-identical UK GDPR after leaving the EU despite being a common law jurisdiction.
Source Major Legal Systems in the World TodayRene David and John E.C. Brierley
Sources
1. General Data Protection Regulation (GDPR) (Wikipedia)
Lead sectionQuote, Lead section
The General Data Protection Regulation (Regulation (EU) 2016/679), abbreviated GDPR, is a European Union regulation on information privacy in the European Union (EU) and the European Economic Area (EEA).
2. EUR-Lex, Official Journal of the European Union
3. General Data Protection Regulation (Wikipedia)
Lead paragraph
The General Data Protection Regulation (Regulation (EU) 2016/679), abbreviated GDPR, is a European Union regulation on information privacy in the European Union (EU) and the European Economic Area (EEA).
Associated With: Children's Online Privacy Protection Act (COPPA), Lead section (special protection for children's data)
unless these interests are overridden by interests of the data subject or her or his rights according to the Charter of Fundamental Rights (especially in the case of children)
In Group: European and British Data Protection Law, Introduction, sentence 1
The General Data Protection Regulation (Regulation (EU) 2016/679), abbreviated GDPR, is a European Union regulation on information privacy in the European Union (EU) and the European Economic Area (EEA).
View the SourceMajor Legal Systems in the World Today
Rene David and John E.C. Brierley, Stevens and Sons, 1985In Legal System: Civil Law
Personal Information Protection Law of the People's Republic of China (Wikipedia)
Reader Challenges (0)
No disputes yet. Spotted an error or a better source? Open the first one.
Sign in to dispute this or suggest a correction.