The General Data Protection Regulation (GDPR) is EU Regulation 2016/679, effective May 25, 2018. It establishes a comprehensive data protection framework for the EU/EEA, replacing the 1995 Data Protection Directive. GDPR applies to any organization that processes personal data of EU/EEA residents, regardless of where the organization is located.

Who must comply with GDPR?

Any organization (data controller or data processor) that processes personal data of EU/EEA residents must comply with GDPR — whether the organization is located in the EU or anywhere in the world. This extraterritorial scope (Article 3) means U.S. companies, Asian companies, and others are subject to GDPR if they offer goods/services to EU residents or monitor their behavior.

GDPR has two tiers of fines. Tier 1 (less severe violations): up to €10M or 2% of total worldwide annual turnover, whichever is higher. Tier 2 (most severe violations, including infringement of the basic principles): up to €20M or 4% of total worldwide annual turnover, whichever is higher. The largest GDPR fine to date is €1.2 billion imposed on Meta by Ireland's DPC in May 2023.

What are the 7 GDPR principles?

Article 5 sets out 7 principles: (1) Lawfulness, fairness and transparency, (2) Purpose limitation — collected for specified, explicit and legitimate purposes, (3) Data minimisation — adequate, relevant and limited to what is necessary, (4) Accuracy, (5) Storage limitation — no longer than necessary, (6) Integrity and confidentiality (security), (7) Accountability — controller must be able to demonstrate compliance.

GDPR Compliance Guide 2026 — General Data Protection Regulation Requirements & Fines

as of March 2026

⚠️

Extraterritorial scope — applies globally. GDPR applies to any organization that processes personal data of EU/EEA residents, regardless of where the organization is based. U.S. companies serving EU customers are subject to GDPR. Article 3(2) explicitly covers non-EU controllers targeting EU data subjects. (GDPR Art. 3)

What Is GDPR?

The General Data Protection Regulation (EU) 2016/679 (GDPR) is a regulation of the European Union on data protection and privacy. It became enforceable on May 25, 2018, replacing Directive 95/46/EC. GDPR is one of the toughest data protection laws in the world. (EUR-Lex)

The regulation applies to the processing of personal data — any information relating to an identified or identifiable natural person (a "data subject"). GDPR distinguishes between data controllers (determine the purpose and means of processing) and data processors (process data on behalf of controllers).

€20M

Max Tier 2 fine (or 4% of global turnover)

€1.2B

Largest single GDPR fine (Meta, May 2023)

72 hrs

Breach notification deadline to SA

30 days

Response time for subject access requests

Lawful bases for processing

4,500+

GDPR fines issued through 2024

The 7 GDPR Principles (Article 5)

All processing of personal data must comply with Article 5's seven principles. Failure to demonstrate compliance with these principles is a Tier 2 violation. (GDPR Article 5)

HIGH ? Data N/A

6 Lawful Bases for Processing (Article 6)

Every processing activity must be based on at least one of the six lawful bases. Consent is not the only option — and is often not the most appropriate one. (GDPR Article 6)

Basis	When Applicable	Key Considerations
Consent (Art 6(1)(a))	Data subject has freely given specific, informed, unambiguous consent	Must be withdrawable; no bundled consent; records required
Contract (Art 6(1)(b))	Processing necessary to perform a contract with the data subject, or pre-contractual steps	Must be genuinely necessary; cannot rely on this for additional purposes
Legal Obligation (Art 6(1)(c))	Processing required by EU or Member State law	Must identify the specific legal obligation in your privacy notice
Vital Interests (Art 6(1)(d))	Processing necessary to protect someone's life (last resort)	Only when data subject is incapable of giving consent
Public Task (Art 6(1)(e))	Processing necessary for a public task or official authority	Primarily for public authorities; some public interest bodies
Legitimate Interests (Art 6(1)(f))	Processing necessary for legitimate interests of controller/third party, not overridden by data subject's interests	Must conduct and document a balancing test (LIA); cannot use for public authorities

Data Subject Rights (Articles 12–22)

GDPR grants eight enforceable rights to data subjects. Organizations must facilitate these rights within one month of receiving a valid request (extendable by two months for complex requests). (GDPR Articles 12–22)

Right to be informed (Arts 13–14): Transparent information about processing at the time of collection via privacy notice
Right of access (Art 15): Obtain confirmation of processing and a copy of personal data (Subject Access Request / SAR)
Right to rectification (Art 16): Correct inaccurate personal data or complete incomplete data without undue delay
Right to erasure / "Right to be forgotten" (Art 17): Erase data when no longer necessary, consent withdrawn, or objection upheld
Right to restriction of processing (Art 18): Pause processing while accuracy, legal basis, or objection is resolved
Right to data portability (Art 20): Receive personal data in a structured, machine-readable format; transmit to another controller (applies to consent and contract bases)
Right to object (Art 21): Object to processing based on legitimate interests or public task, including direct marketing (absolute right to object to marketing)
Rights related to automated decision-making (Art 22): Not to be subject to solely automated decisions with significant effects; right to human review

Data Protection Officer (DPO)

Article 37 mandates a DPO for three categories of organizations. Even where not mandatory, appointing a DPO voluntarily is a recognized best practice. (GDPR Article 37)

DPO mandatory when:

Public authority or body (except courts acting in judicial capacity)
Core activities involve large-scale regular and systematic monitoring of data subjects
Core activities involve large-scale processing of special category data (health, biometric, etc.) or criminal conviction data

DPO responsibilities (Article 39):

Inform and advise the organization and employees of GDPR obligations
Monitor compliance including assignment of responsibilities, training, and audits
Advise on Data Protection Impact Assessments (DPIAs)
Cooperate with the supervisory authority and act as contact point

ℹ️

The DPO must be independent, have expert knowledge of data protection law, and cannot be dismissed or penalized for performing their tasks. Organizations with a DPO must publish DPO contact details and communicate them to supervisory authorities.

Data Breach Notification (Articles 33–34)

A personal data breach that risks the rights and freedoms of individuals must be reported to the supervisory authority within 72 hours of becoming aware. (GDPR Article 33)

Notification to supervisory authority (Art 33) must include:

Nature of the breach, including categories and approximate number of data subjects and records affected
Name and contact details of the DPO or other contact point
Likely consequences of the breach
Measures taken or proposed to address the breach and mitigate its possible adverse effects

Notification to data subjects (Art 34) required when:

The breach is likely to result in a high risk to the rights and freedoms of natural persons
Must be communicated in clear and plain language without undue delay
Exceptions: data was encrypted, remedial action prevents high risk, or communication would involve disproportionate effort (use public communication instead)

GDPR Penalty Tiers

Tier	Violations	Maximum Fine
Tier 1	Violations of controller/processor obligations (Arts 8, 11, 25–39, 42, 43), supervisory authority orders (Art 58(2))	€10,000,000 or 2% of total worldwide annual turnover — whichever is higher
Tier 2	Violations of the basic principles for processing (Arts 5, 6, 7, 9), data subject rights (Arts 12–22), international transfer rules (Arts 44–49), national law requirements	€20,000,000 or 4% of total worldwide annual turnover — whichever is higher

Largest GDPR Fines (as of 2024)

Company	Fine	Authority	Year	Violation
Meta (Facebook)	€1.2B	DPC (Ireland)	2023	Unlawful transfer of EU user data to U.S. without adequate safeguards
Amazon	€746M	CNPD (Luxembourg)	2021	Advertising targeting system violated GDPR consent rules
Instagram (Meta)	€405M	DPC (Ireland)	2022	Children's data published publicly; inadequate privacy defaults
WhatsApp (Meta)	€225M	DPC (Ireland)	2021	Transparency failures in data processing information
Google LLC	€60M	CNIL (France)	2021	Cookie rejection mechanism inadequate (3 clicks vs 1 for acceptance)

Source: CMS Law GDPR Enforcement Tracker (enforcementtracker.com)

International Data Transfers

Transferring personal data to countries outside the EU/EEA requires an appropriate safeguard unless the destination country has received an adequacy decision. (GDPR Chapter V)

Mechanism	Description	Notes
Adequacy decision (Art 45)	EC declares recipient country has "essentially equivalent" protection	UK, Switzerland, Japan, Canada, Israel, South Korea among others; U.S. Data Privacy Framework (July 2023)
Standard Contractual Clauses (Art 46(2)(c))	EC-approved contract templates (SCCs) between data exporters and importers	2021 SCCs replaced old versions; Transfer Impact Assessment (TIA) recommended post-Schrems II
Binding Corporate Rules (Art 47)	Internal policies for intra-group transfers, approved by lead supervisory authority	Suitable for multinational groups; time-intensive to obtain
Derogations (Art 49)	Specific situations: explicit consent, contract performance, vital interests, public interest, legal claims	Cannot be used for systematic/repetitive transfers; last resort

GDPR Compliance Checklist

Data mapping / Records of Processing Activities (ROPA) completed and maintained (Article 30)
Lawful basis identified and documented for every processing activity
Privacy notices updated to include all Article 13/14 required information
Consent mechanisms are specific, informed, freely given, and unambiguous; withdrawal is as easy as giving consent
Data subject request procedures in place; 30-day response window tracked
Data Protection Officer (DPO) appointed if required; contact details published
Data Protection Impact Assessments (DPIAs) conducted for high-risk processing activities
Vendor contracts include GDPR-compliant Data Processing Agreements (DPAs)
International transfers use appropriate safeguards (adequacy decision, SCCs, BCRs)
Data breach response procedure documented; 72-hour SA notification process tested
Cookie consent mechanism implemented for non-essential cookies; single-click rejection available
Data retention schedules defined and enforced; deletion/anonymization processes automated
Privacy by design and by default incorporated into new product/service development
Staff data protection training conducted and recorded annually

(EDPB Guidelines)

Related Tools & Resources

Related Compliance Guides

Stay ahead of EU data protection developments

GDPR enforcement updates, regulatory changes, and compliance guides — free weekly.

Subscribe to The Finance Stack All Compliance Guides →

GDPR Compliance Guide 2026