GDPR: What It Is and How Purplecop Helps

What is the GDPR?

The General Data Protection Regulation is Regulation (EU) 2016/679 of 27 April 2016 "on the protection of natural persons with regard to the processing of personal data and on the free movement of such data". It entered into force on 24 May 2016, applies from 25 May 2018 (Article 99), and is "binding in its entirety and directly applicable in all Member States."

The European Commission says it has been incorporated into the EEA Agreement, so it applies throughout the European Economic Area. Each Member State has independent supervisory authorities that monitor and enforce it (Articles 51 and 57). This page is general information, not legal advice.

Who does the GDPR apply to?

Article 3 sets two main limbs:

• Establishment: processing "in the context of the activities of an establishment of a controller or a processor in the Union", wherever the processing takes place.
• Targeting: processing of personal data of people in the Union by a controller or processor not established there, where it relates to offering goods or services to them (paid or not) or monitoring their behaviour within the Union.

What principles and lawful bases does the GDPR set?

Article 5 sets six principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality. The controller must be "able to demonstrate compliance" (Article 5(2)).

Processing is lawful only if a basis in Article 6(1) applies: consent; contract; legal obligation; vital interests; public interest or official authority; or legitimate interests, unless overridden by the person's rights and freedoms.

Where consent is the basis, the controller must be able to demonstrate it, and withdrawing must be as easy as giving it (Article 7). Special categories, such as health data, are prohibited unless an Article 9(2) condition applies, for example explicit consent.

What rights do individuals have under the GDPR?

Individuals have rights to information (Articles 13 and 14), access (15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), and not to be subject to certain solely automated decisions (22).

The controller must respond "without undue delay and in any event within one month of receipt of the request", extendable by two further months where necessary (Article 12(3)).

People may complain to a supervisory authority (Article 77), seek a judicial remedy (Article 79) and claim compensation for damage (Article 82).

What must organisations do to meet the GDPR?

Main duties include:

• Accountability: appropriate technical and organisational measures to ensure and demonstrate compliance (Article 24), and data protection by design and by default (Article 25).
• Processors: use only those giving sufficient guarantees, under a contract with the terms Article 28 lists.
• Records of processing activities (Article 30), with an exemption for organisations under 250 people that falls away in some cases (Article 30(5)).
• Security appropriate to the risk, which may include pseudonymisation, encryption, resilience and regular testing (Article 32).
• Impact assessments before processing likely to result in a high risk (Article 35).
• A data protection officer where Article 37(1) applies, such as public authorities or large-scale regular monitoring.
• International transfers only under Chapter V, for example under a Commission adequacy decision (Article 45) or Commission-adopted standard data protection clauses (Article 46(2)(c)).

What is the GDPR 72-hour breach rule?

A personal data breach is a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Article 4(12)).

The controller must notify the supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware of it", unless the breach is unlikely to risk people's rights and freedoms. Later notice must give reasons (Article 33(1)). Processors must tell the controller without undue delay (Article 33(2)), and every breach must be documented (Article 33(5)). If a breach is likely to result in a high risk to people, they must be told too, unless an exception applies (Article 34).

What are the penalties for breaching the GDPR?

Authorities can impose administrative fines that are "effective, proportionate and dissuasive" (Article 83(1)). There are two ceilings:

• Up to EUR 10,000,000, or for an undertaking up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher, for infringements including controller and processor obligations in Articles 25 to 39 (Article 83(4)).
• Up to EUR 20,000,000, or up to 4%, whichever is higher, for infringements including the basic principles and consent (Articles 5, 6, 7, 9), data subject rights (Articles 12 to 22) and transfers (Articles 44 to 49) (Article 83(5)).

Does Purplecop help with the GDPR?

Purplecop Security's GRC & Compliance Advisory service lists GDPR under "Framework adoption", alongside ISO/IEC 27001, SOC 2, NIST CSF 2.0, PCI DSS, HIPAA and DPDPA. Its page also describes a "Gap assessment against your target framework, with a prioritised remediation plan".

The Purplecop Privacy page describes a global engine covering "17 privacy laws across 40 countries on one records-and-rights engine" and names GDPR and CCPA/CPRA. Its listed modules include consent and notice, data principal rights, records of processing (ROPA), DPIA, cross-border transfers and a breach workflow.

Neither the service nor the product makes an organisation GDPR compliant. That responsibility rests with the controller or processor, and enforcement with the supervisory authorities. For India's law, see the DPDP Act page.

Does the GDPR apply to companies outside the EU?

It can. Article 3(2) applies it to controllers and processors outside the Union that process personal data of people in the Union in connection with offering them goods or services, or monitoring their behaviour there.

What is the difference between a controller and a processor?

A controller decides the purposes and means of processing. A processor processes personal data on its behalf (Article 4(7) and (8)), under a contract or other legal act (Article 28(3)).

Does every organisation need a data protection officer?

No. Article 37(1) requires one for public authorities and for controllers or processors whose core activities involve large-scale regular and systematic monitoring, or large-scale special-category or criminal-offence data.

Is there an official GDPR certification?

The Regulation encourages voluntary certification mechanisms, seals and marks (Article 42). Certification "does not reduce the responsibility" of the controller or processor, and is issued for a maximum of three years by certification bodies or the competent supervisory authority.

What is the maximum GDPR fine?

Article 83(5) sets a ceiling of EUR 20,000,000 or, for an undertaking, 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. It is a ceiling, not a standard fine.

Can Purplecop make my organisation GDPR compliant?

No. Compliance is the legal responsibility of the controller or processor. Purplecop Security's GRC & Compliance Advisory service lists GDPR in its framework adoption work.