GDPR

In force

Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation)

As of: 2026-08-02 Maintained by: Ruth/Content

This applies to you if …

You process personal data of people in the EU (customers, users, employees).
You run a website with a contact form, newsletter, login or analytics tools.
You engage service providers (hosting, cloud, AI vendors) that process data on your behalf.

Core obligations

Ensure a legal basis for every processing activity (e.g. consent, contract, legitimate interest).
Uphold the principles: purpose limitation, data minimisation, storage limitation, transparency and security of processing.
Fulfil data-subject rights (access, rectification, erasure, portability, objection).
Maintain a record of processing, sign data-processing agreements and report data breaches within 72 hours (current law; Art. 33). Note: the EU 'Digital Omnibus' proposes simplified obligations (e.g. record-keeping threshold raised from 250 to 750 employees, breach-reporting deadline 72 → 96 hours) — as of 08/2026 only a proposal in the legislative process, NOT yet current law.

Keep reading — free

Unlock the full content

Enter and confirm your email address: you subscribe to the Signal Forge newsletter by FORGE and get instant access to this and all other registration-gated content. You can unsubscribe at any time.

Already registered? The link from your confirmation email unlocks this device again.

First steps

Create a record of processing activities (what data, for what purpose, how long, to whom).
Document the legal basis for each processing and make consents auditable.
Set up a privacy notice, consent mechanisms and a data-subject-rights process.
Conclude data-processing agreements with all providers and document technical/organisational measures.

Deadlines

2016-05-24Regulation entered into force
2018-05-25Full applicability — binding across the entire EU since then

Penalty for non-compliance

Fines up to EUR 20 million or 4 % of worldwide annual turnover (whichever is higher) for serious infringements; tiered framework for other infringements.