The General Data Protection Regulation (GDPR)

The General Data Protection Regulation is Regulation (EU) 2016/679. The European Parliament gave its final approval on 14 April 2016. That vote ended more than four years of work on a full overhaul of the EU’s data rules. The regulation itself is dated 27 April 2016. It replaced the 1995 Data Protection Directive.

1.1 Why did the EU replace a 1995 law?

The old directive dated from 1995, when the internet was still in its infancy. The new regulation was built for a world of smartphones, social media, internet banking and global data transfers. The Commission adds a second reason. One single law cuts the fragmentation between national systems and removes needless paperwork for firms.

Think of a firm that sells in ten EU countries. Under ten slightly different national laws, it needs ten sets of rules. Under one regulation, it needs one.

1.2 Is a regulation different from a directive?

Yes, and the difference is easy to test. The European Parliament’s own release shows both in one package. The regulation is described as directly applicable in all member states, two years after it enters into force. The separate directive on policing data needs a different route. Member states had two years to turn its provisions into national law.

• A regulation is directly applicable in every member state.
• A directive must be turned into national law by each member state.

1.3 Why do two dates matter?

The regulation entered into force on 24 May 2016. It has applied since 25 May 2018. That gave organisations about two years to get ready. Exam questions often ask for the enforcement date, not the adoption date.

A common slip is to say “GDPR 2016”. Parliament voted in 2016 and the law entered into force in 2016. The duties on firms began only in 2018. Match the question’s wording to the right date.

1.4 Is the GDPR only for the EU?

The GDPR is part of the EEA Agreement. That makes it apply across the European Economic Area. The EU’s data law also includes the Law Enforcement Directive (2016/680) and the EUDPR (Regulation 2018/1725) for EU bodies.

So “GDPR” is one law in a family of three. Each covers a different set of bodies.

The European Parliament said the new rules give citizens more control over their private data. The rapporteur put the idea simply. Citizens will decide for themselves which personal information they want to share. The rules include these rights.

• A right to be forgotten.
• Clear and affirmative consent to process personal data.
• A right to transfer data to another service provider.
• A right to know when data has been hacked.
• Privacy policies in clear and plain language.

2.1 What do these rights mean in daily life?

Take each right as a short story.

• Right to be forgotten: a person can ask for old data to be erased.
• Clear and affirmative consent: the person must clearly say yes before data is processed.
• Transfer your data: a user can move to a rival service and take the data along.
• Hack notice: if data is stolen, the person has the right to know.
• Plain language: the privacy policy must be easy to read.

2.2 How big are the fines?

The same release says enforcement is stronger. Fines can reach 4% of a firm’s total worldwide annual turnover. This works as a deterrent.

Worked example. A firm earns €10 billion worldwide in a year. Four per cent of that is €400 million. That is the ceiling, not a fixed price. The words are “up to”.

2.3 Does the GDPR also cover police data?

Not directly. The data protection package had two parts. The regulation is the general law. A separate directive covers data transfers for policing and judicial purposes. It sets minimum standards for data used to prevent, investigate and prosecute crime.

Exam trap: do not call the policing directive “the GDPR”.

Any organisation established in the EU must follow it. Article 3(2) reaches firms not established in the EU in two cases. They must be offering goods or services to people in the EU, even if free. Or they must be monitoring the behaviour of people in the EU.

3.1 Does holding EU citizens’ data always trigger it?

No. The EDPB says processing EU citizens’ data in a third country does not trigger the GDPR by itself. It must relate to an offer aimed at people in the EU, or to monitoring their behaviour there. Its example is a bank in Taiwan serving customers who hold German citizenship. That bank is not subject to the GDPR.

3.2 How does a regulator tell if a firm is “targeting” the EU?

Simply being reachable is not enough. A website that anyone can open from the EU does not make a firm a target. The EDPB lists clues that show real intent. They include these.

• A language or currency used in EU states, with a way to order in it.
• A domain name such as .de or .eu, rather than the firm’s home domain.
• Phone numbers meant for callers from EU countries.
• Mention of customers in the EU.

3.3 Which worked examples should I remember?

The EDPB gives examples. They show the line between covered and not covered.

3.4 What must such a firm do?

A firm outside the EU that falls under Article 3(2) must designate a representative in the Union.

The European Data Protection Board (EDPB) is an independent European body. It makes sure the GDPR is applied consistently. It can adopt binding decisions to settle disputes between national supervisory authorities.

4.1 Who does what?

Two levels share the work. The national supervisory authorities enforce the GDPR in their own countries. The EDPB sits above them for hard cases. Its binding decisions are addressed to the national authorities. They are used when the authorities cannot agree on a cross-border case.

Think of it as a referee. National teams play the match. The referee steps in when two teams disagree.

4.2 What else does the Board do?

Binding decisions are the rare tool. The everyday tools are softer.

• It issues guidelines and best practices so everyone reads the law the same way.
• It gives opinions to the European Commission and to national authorities.
• It supports cooperation between authorities, including on enforcement.

The territorial scope guidelines used in this lesson are one example.

4.3 What is new on enforcement?

In May 2025 the Council and Parliament agreed new procedural rules for the GDPR. They aim at faster action in large cross-border cases. They set fixed deadlines for a draft decision and clearer rules for complaints. The Commission says they do not change people’s rights or firms’ duties. When the Commission page was saved, the text was still going through formal adoption.

India’s Digital Personal Data Protection Act, 2023 was enacted by Parliament on 11 August 2023. The DPDP Rules, 2025 were notified on 14 November 2025. The Rules give a phased eighteen-month compliance period.

5.1 What words does India use?

India calls the organisation a Data Fiduciary. It is the entity that decides why and how personal data is processed. The person whose data it is, is the Data Principal. For a child, this includes a parent or lawful guardian. A Data Protection Board of India oversees compliance. Appeals go to TDSAT. The highest penalty is up to ₹250 crore.

5.2 What does the DPDP Act ask of a firm?

The Act rests on seven principles: consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability. Three rules from the Rules stand out.

• Each firm must give a separate, clear consent notice that states the purpose.
• Requests to access, correct or erase data must be answered within ninety days.
• For a child, a parent or guardian must give verifiable consent. Essential services such as healthcare, education and real-time safety are exempt.

5.3 How do the penalties compare?

India uses fixed rupee ceilings. The EU uses a share of turnover.

• Up to ₹250 crore: failing to keep reasonable security safeguards.
• Up to ₹200 crore: not reporting a breach, or breaking the rules on children.
• Up to ₹50 crore: any other violation.

5.4 Which side-by-side facts should I remember?

Do not mix the labels. The word “fiduciary” belongs to India’s Act.

UPSC asked about the GDPR in the Civil Services Preliminary Examination 2019. The stem names the law, April 2016 and 25 May 2018. The answer is the European Union.

UPSC Civil Services (Preliminary) Examination 2019, General Studies Paper I, Series A, Q88.
Which of the following adopted a law on data protection and privacy for its citizens known as ‘General Data Protection Regulation’ in April 2016 and started implementation of it from 25th May, 2018?
(a) Australia
(b) Canada
(c) The European Union
(d) The United States of America

Read the UPSC question paper (Series A, printed page 39) and the UPSC answer key. The key gives (c). The stem gives the two dates a student must know: the April 2016 adoption and the 25 May 2018 start.

6.1 How do the two dates in the stem fit?

The stem gives two dates. April 2016 matches Parliament’s final approval on 14 April 2016. 25 May 2018 matches the day the regulation began to apply. Once the dates match this lesson, the answer follows.

6.2 What would a clever examiner change next?

A harder question could swap the dates, or ask about reach or rights. Use this checklist.

• Adopted means 14 April 2016. In force means 24 May 2016. Applies means 25 May 2018.
• Firms outside the EU are covered only if they target people in the EU.
• Fines are “up to 4%” of worldwide turnover.
• The EDPB settles disputes. National authorities enforce.
• India’s terms are Data Fiduciary and Data Principal.