GDPR: what it is, what rights it protects, and what your company must comply with
Every day we share personal data when registering on a website, making a purchase, sending an email, or using an application. Our name, email address, photographs, and other data make it possible to identify us and form part of our digital identity. Protecting this information is essential to ensure our privacy and prevent misuse.
To this end, the European Union has the General Data Protection Regulation (GDPR), commonly referred to as GDPR. Applicable since 25 May 2018, it sets out the rules that organizations must follow when processing personal data and grants individuals greater control over their information.
But what does this regulation actually imply? What rights do individuals have, and what obligations must companies meet?
What is GDPR and what is its purpose?
The General Data Protection Regulation is the European regulation governing the processing of personal data and protecting individuals' rights and freedoms.
Its objective is to ensure that personal information is collected, used, retained, and shared lawfully, transparently, and securely. To achieve this, it establishes principles and obligations that must be taken into account throughout the entire data lifecycle, from collection to deletion.
GDPR applies to organizations established in the European Union that process personal data and, under certain circumstances, also to organizations outside the EU that offer goods or services to individuals in the EU or monitor their behavior.
In practice, it affects everyday activities such as managing a customer database, processing job applications, sending commercial communications, or using tech systems that process personal information.
The key principles of GDPR
The regulation sets out a series of principles that must guide any processing of personal data. It is not only about protecting information against unauthorized access, but also about ensuring it is used appropriately.
1. Lawfulness, fairness, and transparency
Companies must have a valid legal basis for processing data and clearly explain to individuals what information they collect, for what purpose, and how they use it.
Privacy information must be understandable and accessible, avoiding confusing or overly technical explanations.
2. Purpose limitation
Data must be collected for specified, explicit, and legitimate purposes. A company cannot collect information without a defined purpose, nor use it later for objectives incompatible with those that justified its collection.
For example, having a customer's data to process an order does not automatically authorize using it for any commercial campaign.
3. Data minimization
Only personal data that is adequate, relevant, and limited to what is necessary for the intended purpose should be collected.
This means accumulating information just in case it might be useful in the future is not good practice. Companies must review what data they actually need and avoid collecting data that adds no value to the processing.
4. Accuracy
Personal data must be accurate and, where necessary, kept up to date. Organizations must take reasonable steps to rectify or erase inaccurate information, taking into account the purpose for which it is processed.
Keeping a database up to date helps both to comply with regulations and to avoid errors in relationships with customers, suppliers, and employees.
5. Storage limitation
Personal data must not be kept for longer than is necessary for the purposes for which it was collected, unless there is a legal justification for retaining it for a specified period.
Therefore, it is important to establish retention criteria and procedures to review, delete, or anonymize information where appropriate.
6. Integrity and confidentiality
Organizations must implement appropriate technical and organizational measures to protect data against unauthorized access, loss, accidental destruction, or damage.
Measures that may be appropriate include access control, permissions management, encryption, backups, and staff training. Specific measures must be tailored to the risks of each processing activity.
7. Accountability
Complying with GDPR is not simply a matter of stating that its principles are respected. The company must be able to demonstrate that it applies them.
This involves documenting decisions taken, maintaining appropriate records, reviewing risks, and verifying that protection measures work.
In addition, some organizations must appoint a Data Protection Officer (DPO), subject to the criteria set out in the regulation and applicable law. It is not an automatic requirement for all companies.
What rights does GDPR grant to individuals?
The regulation grants several rights that enable individuals to know about and control the use of their personal data. Companies must have procedures in place to handle these requests within legal timeframes.
Right of access
Allows individuals to request information on whether an organization is processing personal data and, where applicable, access that data and learn specific details about the processing.
Right to rectification
Allows individuals to request that inaccurate personal data be corrected or incomplete data be completed, as appropriate.
Right to erasure
Also known as the right to be forgotten in certain contexts, it allows individuals to request the deletion of data when conditions set out in GDPR are met.
It is not an absolute right: legal obligations or other legitimate grounds may justify retaining certain information.
Right to restriction of processing
In certain cases, it allows individuals to request a temporary restriction on the use of their personal data, for instance, while its accuracy is being verified or an objection to processing is resolved.
Right to data portability
Allows individuals to receive certain personal data in a structured, commonly used, and machine-readable format, and to transmit it to another organization when conditions set by the regulation are met.
This right applies, among other requirements, to certain automated processing based on consent or a contract.
Right to object
Allows individuals to object to certain processing of personal data under circumstances provided by law. In the case of direct marketing, the objection has a specific scope: when an individual objects to processing for that purpose, data must no longer be processed for that goal.
Right not to be subject to automated decision-making
GDPR also provides safeguards against decisions based solely on automated processing, including profiling, where they produce legal effects or similarly significantly affect an individual.
These rights are not absolute, and their application depends on the circumstances. Therefore, organizations must evaluate each request in accordance with the regulation.
How does GDPR affect companies?
Complying with GDPR requires reviewing how personal data is collected, used, stored, shared, and erased within the organization.
Responsibility does not fall solely on the legal department or the privacy officer. It can affect marketing, human resources, sales, customer support, IT, and any other department processing personal information.
Key tasks a company may need to undertake include:
Identifying data processing activities: understanding what information is collected, where it comes from, what it is used for, and who can access it.
Determining the legal basis: verifying which legal grounds permit each processing activity. Consent is one possible basis, but not the only one.
Providing clear information: offering transparent information regarding purposes, retention periods, and individuals' rights.
Managing rights: establishing a procedure to receive, verify, and respond to requests.
Implementing security measures: protecting information through controls proportionate to the risks.
Reviewing vendors and data processors: ensuring that necessary guarantees and agreements are in place when third parties process data on behalf of the company.
Managing security incidents: having procedures to assess personal data breaches and satisfy notification obligations where applicable.
Training staff: ensuring that personnel who handle data understand their responsibilities.
Documenting compliance: retaining the documentation required to demonstrate that relevant measures have been implemented.
Not all companies need the exact same measures. Specific obligations depend on factors such as the nature of the data, the processing activities carried out, the risks, and the characteristics of the organization.
The impact of GDPR beyond the European Union
Although GDPR is a European regulation, its reach can extend to organizations located outside the European Union.
For instance, a company established in another country may fall within the scope of the regulation if it offers goods or services to individuals in the EU or monitors their behavior within the Union, provided statutory criteria are met.
This is particularly relevant for organizations operating online, using international vendors, or managing customer databases across multiple countries.
In these cases, it is necessary to analyze where affected individuals are located, what activities the company performs, and which processing operations are subject to the regulation. Conditions applying to international data transfers must also be reviewed.
What are the consequences of non-compliance with GDPR?
Failure to comply with the regulation can lead to investigations, corrective orders, and administrative fines, alongside potential claims and reputational damage.
GDPR provides for fines that, depending on the infringement, can reach up to €10 million or 2% of total worldwide annual turnover for the preceding financial year, or up to €20 million or 4%, respectively, applying whichever amount corresponds under the regulation.
The specific amount depends on factors such as the nature, gravity, and duration of the infringement, the degree of responsibility, and the measures taken to mitigate its consequences.
Therefore, GDPR compliance is not merely about avoiding a fine. It also helps reduce risks, streamline internal processes, and reinforce the trust of customers, employees, and partners.
Data protection: more than a legal obligation
The General Data Protection Regulation establishes a common framework to protect personal information and ensure organizations process it responsibly.
Applying it correctly requires knowing what data the company handles, defining the purposes of each processing operation, limiting the information collected, and establishing adequate security measures. It also requires periodically reviewing procedures and demonstrating that applicable obligations are being met.
Privacy should not be treated as a one-off task solved by drafting a policy or accepting a legal notice. It must be integrated into organizational processes and decisions.
Protecting personal data is also a way to protect trust. When a company manages information with transparency, accountability, and security, it helps build stronger, more sustainable relationships.
Is your company prepared to comply with GDPR?
To facilitate an initial review, we have prepared a two-page checklist PDF summarizing key aspects to review when managing personal data.
This checklist will help you identify pending tasks and check whether your company has addressed issues such as informing data subjects, the legal basis for processing, managing rights, security, and documentation.
Download the document and use it as a starting point to review your procedures. Keep in mind that this is an initial guide: completing it does not in itself guarantee GDPR compliance, as obligations depend on the characteristics and risks of each organization.