GDPR
Also: General Data Protection Regulation, Regulation (EU) 2016/679, Règlement Général sur la Protection des Données, RGPD, Datenschutz-Grundverordnung, DSGVO, EU Data Protection Regulation
EU regulation governing how organizations collect, store and use personal data, with fines tied to global revenue for breaches.
What It Is
GDPR (General Data Protection Regulation) is the European Union law that sets the rules for handling personal data of people in the EU. It applies to any organization that processes EU residents' data, regardless of where that organization is based. A US company selling to French customers is bound by it. Personal data means anything that can identify a person: name, email, IP address, location, purchase history, even a cookie ID.
Why it matters
GDPR carries penalties large enough to reach the CFO's attention: fines can climb to a percentage of worldwide annual turnover, not just local revenue. A single compliance failure can turn a routine marketing campaign into a board-level financial and reputational risk. Beyond fines, it shapes what your teams can actually do. A CMO who wants to buy a third-party audience list, a CDO building a customer data platform, or an AI lead training a model on customer records all hit the same question: do we have a lawful basis to use this data? Consent obtained badly, or data kept longer than needed, becomes a liability rather than an asset.
How it works
GDPR runs on a few core mechanisms. You need a lawful basis for every use of personal data, most often consent or legitimate interest, and you must be able to prove it. Individuals hold rights: to access their data, correct it, delete it ("right to be forgotten") and object to profiling. In practice a leader meets GDPR when signing off a new tool. Example: your team wants to enrich the CRM with an outside data provider. Legal will ask where consent came from, how long records are retained, and whether a Data Protection Impact Assessment is required. If a breach occurs, you generally have a tight window (72 hours) to notify the regulator. Building consent capture, retention limits and deletion workflows into systems from the start is far cheaper than retrofitting them after an audit.
Frequently asked questions
What is GDPR and who does it apply to?
GDPR (General Data Protection Regulation) is the EU law that governs how organizations collect, store and use the personal data of people in the EU. It applies based on whose data you process, not where your company sits: a US business selling to French customers falls under it. Personal data covers anything that identifies someone, from a name or email to an IP address or cookie ID.
Why does GDPR concern executives and not just the legal team?
Because the fines are calculated on a percentage of worldwide annual turnover, not local revenue, which puts a compliance failure at board level rather than in a legal file. GDPR also constrains what teams can actually do: buying a third-party audience list, building a customer data platform or training a model on customer records all raise the same question of lawful basis. Badly collected consent turns a data asset into a liability.
What does "lawful basis" mean under GDPR?
A lawful basis is the legal justification required for every use of personal data under GDPR, most often consent or legitimate interest. You need one for each processing purpose, and you must be able to prove it if a regulator asks. Reusing data collected for one purpose in another context without checking the basis is a common failure point.
What rights do individuals have over their data under GDPR?
Under GDPR, individuals can access the data held about them, have it corrected, request its deletion (the "right to be forgotten") and object to profiling. These rights are operational, not theoretical: your systems need workflows that can actually find, export and erase a person's records. Retrofitting deletion into a data stack after an audit costs far more than designing it in from the start.
How long do you have to report a data breach under GDPR?
GDPR gives you a tight window, generally 72 hours, to notify the regulator after a personal data breach. That deadline assumes detection and escalation paths already exist, which is why breach response is a process question before it is a legal one. Teams that discover a breach late have already burned most of the clock.