The GDPR (General Data Protection Regulation) is an EU law in force since 2018 that sets rules for processing personal data and gives individuals rights over it. It applies to any organization handling data of people in the EU, wherever the organization is based.
Why it matters
It requires a lawful basis for processing, data minimization, appropriate security, and breach notification to the regulator generally within 72 hours. Individuals can access, correct and request deletion of their data. Penalties can be substantial, so websites with EU visitors must handle cookies, privacy notices and requests properly.
Example
A user emails your shop asking for a copy of all the data you hold on them. Under the GDPR you must respond, normally within one month, and delete the data on request unless a legal reason requires keeping it.
Common mistakes
- Thinking it applies only to EU-based companies.
- Using pre-ticked boxes or cookie banners without a real choice.
- Treating compliance as a one-time document rather than ongoing practice.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.