The General Data Protection Regulation (GDPR) – Regulation 2016/679 – came into full force on May 25, 2018, revolutionizing how organizations handle personal data across the European Union. In this GDPR Easy Guide, we break down the key aspects of the regulation in a simple, non-technical way to help individuals and businesses better understand their responsibilities and rights.

What Is GDPR and Why It Matters

As a regulation, GDPR applies automatically in all EU member states without requiring individual national laws to enforce it. Unlike a directive, which only suggests a legal direction for member states, a regulation is binding in full.

The goal of GDPR is to protect the personal data of European citizens, ensuring their rights and freedoms are respected. Importantly, the regulation applies not only to companies within the EU but also to any organization worldwide that processes personal data of EU residents.

This GDPR Easy Guide will help you distinguish personal data from other forms of company data, like patents or financial reports, and clarify the roles and responsibilities involved in processing such data. If you still have concerns, contact our cybersecurity compliance experts for guidance tailored to your organization.

Key GDPR Definitions You Need to Know

Understanding the core terminology is essential for grasping GDPR compliance.

Personal Data

As defined in Article 4, personal data is any information that can identify a person – directly or indirectly. This includes names, email addresses, ID numbers, or even a car’s license plate when linked to an individual.

Data Processing

This covers a wide range of operations: collecting, storing, altering, using, sharing, or deleting personal data, whether automated or manual.

Data Subject

This refers to the individual whose data is being processed – essentially, you.

Data Controller and Processor

• Data Controller: The entity deciding why and how data is processed
• Processor: Acts on behalf of the controller to carry out data operations

Data Protection Officer (DPO)

An expert in data privacy, often required for public authorities or large-scale data processors, who advises on GDPR compliance.

Special Categories of Personal Data

These were previously known as “sensitive data” and include details like racial or ethnic origin, religious beliefs, biometric data, and health or sexual orientation information.

Personal Data Breach

Any accidental or unlawful destruction, loss, or unauthorized access to personal data is considered a breach and must be reported under GDPR.

Pseudonymization

A security method where identifiable information is separated from personal data through an additional “key” (such as a code), which makes identification difficult without access to both data sets.

Rights of Data Subjects: What Citizens Can Expect

This GDPR Easy Guide wouldn’t be complete without outlining the rights GDPR grants to individuals:

Transparency and Communication

Organizations must clearly explain how they use personal data and facilitate access to that data for the individual.

Right to Access

You can request to see, modify, or delete any personal data an organization holds about you.

Right to Rectification and Erasure

You have the right to correct inaccurate data or request its deletion (“right to be forgotten”).

Right to Data Portability

You can ask organizations to provide your data in a machine-readable format – useful for switching service providers.

Right to Object

You may object to your data being processed, especially for direct marketing or profiling purposes.

Restrictions and Exceptions

Certain rights can be limited under specific conditions, such as national security or public safety.

Responsibilities of Organizations

GDPR places a strong emphasis on accountability. Controllers and processors must:

• Keep detailed records of data processing activities
• Use encryption or pseudonymization where applicable
• Perform Data Protection Impact Assessments for high-risk processing
• Notify authorities within 72 hours of discovering a data breach

Article 33 is especially crucial – it mandates that any data breach likely to affect individuals must be reported to a supervisory authority, such as Italy’s Garante per la protezione dei dati personali, within the 72-hour window.

GDPR Fines and Enforcement: Why It Pays to Comply

GDPR isn’t just about guidelines – it comes with severe penalties for non-compliance. Fines can reach up to €20 million or 4% of a company’s global annual turnover, depending on the severity of the violation.

According to the latest DLA Piper “GDPR Fines and Data Breach Survey” (January 2025), a total of €1.2 billion in GDPR fines were issued across Europe during 2024 – a 33% decline from the record year of €2.9 billion in 2023. While this drop may appear as a trend shift, enforcement momentum remains strong.

Since GDPR took effect in May 2018, cumulative fines now exceed €5.88 billion across Europe, highlighting persistent regulatory vigilance.