Data Privacy and GDPR

The General Data Protection Regulation (GDPR), in force since 2018, is the European Union's data protection law and the de facto global benchmark for privacy regulation. It grants individuals (data subjects) rights over their personal data, imposes obligations on organisations that process it, and backs both with meaningful fines. Its influence extends far beyond Europe: through extraterritorial scope, it shapes how organisations worldwide handle EU residents' data, and it has been the template for privacy laws from Brazil to India.

GDPR's enforcement has been substantial. Cumulative fines have reached billions of euros, with landmark penalties against the largest technology firms. The regulation has real teeth, and the risk of non-compliance is financial, operational, and reputational. Compliance is not a one-off project; it is an ongoing programme, because the regulation's principles apply continuously to changing data processing.

This page covers the GDPR framework, data subject rights, controller and processor obligations, enforcement and fines, cross-border data transfers, and the global privacy-law wave including India's DPDP Act 2023.

GDPR regulates the processing of personal data — any information relating to an identified or identifiable person. It rests on principles: lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. The principles are not aspirational; they are enforceable obligations, and the accountability principle requires organisations to demonstrate compliance, not just claim it.

The regulation distinguishes controllers (who determine the purposes and means of processing) from processors (who process on the controller's behalf). The roles carry different obligations, but both are within GDPR's scope and both can face enforcement. The controller-processor relationship is governed by a contract (Article 28) that allocates responsibilities — a core compliance artefact for any organisation using vendors to process personal data.

Extraterritorial scope is what makes GDPR global. It applies to any organisation processing EU residents' personal data in connection with offering goods or services or monitoring behaviour — regardless of where the organisation is. A US or Indian firm serving EU customers is within GDPR's scope. This extraterritorial reach is why GDPR has become the global default: compliance with it largely complies with other regimes, making it the efficient choice for multinationals.

GDPR grants eight rights to data subjects. The right to be informed (privacy notices), the right of access (what do you have about me?), the right to rectification (correct inaccurate data), the right to erasure ('right to be forgotten' in some cases), the right to restrict processing, the right to data portability (take my data elsewhere in a usable format), the right to object (to certain processing), and rights around automated decision-making (including profiling).

The rights are operational, not theoretical. Organisations must have processes to receive and fulfil subject rights requests within one month, with extensions in complex cases. The operational challenge is significant: identifying the data subject's personal data across all systems, assessing the request against the legal basis and exceptions, and fulfilling (access, rectification, erasure, portability) within the deadline. Failing to fulfil a valid request is itself a violation.

The right to erasure ('right to be forgotten') is the most contested. It applies where data is no longer necessary, consent is withdrawn, processing is unlawful, or the data subject objects (in some cases) — but it has exceptions (legal obligations, freedom of expression, public interest). The balance between erasure and these exceptions has produced significant case law and guidance. The operational point is that erasure is context-dependent, not automatic, and the organisation must assess each request against the exceptions.

Controllers — the organisations that decide why and how personal data is processed — carry the primary obligations. They need a legal basis for each processing activity (consent, contract, legal obligation, vital interests, public task, or legitimate interests), they must conduct Data Protection Impact Assessments for high-risk processing, they must appoint a Data Protection Officer in some cases, they must maintain records of processing activities, and they must notify breaches within 72 hours.

Processors — the vendors that process on the controller's behalf — have narrower but real obligations, governed by the Article 28 contract: process only on the controller's instructions, ensure security, assist with subject rights and breach response, and not engage sub-processors without consent. The processor is liable for failing its obligations, and the controller is liable for choosing a non-compliant processor — the due diligence on vendors is a controller obligation.

The 72-hour breach notification is one of the most operationally demanding obligations. When a personal data breach occurs, the controller must notify the supervisory authority within 72 hours unless the breach is unlikely to risk individuals' rights. The clock starts when the controller becomes aware, not when the breach started — but 'awareness' is interpreted strictly. The operational implication is incident-response processes that can assess, document, and notify within 72 hours, which requires preparation, not improvisation.

GDPR's fines are among the largest in any regulatory regime: up to €20 million or 4% of global annual turnover, whichever is higher. Cumulative fines by the mid-2020s have reached billions of euros, with landmark penalties against the largest technology firms for violations including unlawful processing, inadequate consent, and failure to comply with subject rights requests. The enforcement is real, not theoretical.

The enforcement is also increasingly specific. Supervisory authorities have moved from early guidance-focused enforcement to detailed, specific determinations — on what constitutes valid consent, on the limits of legitimate interests, on the obligations around targeted advertising, on the use of personal data in AI training. Each major decision clarifies the standard, and the standard is becoming stricter, not more permissive.

The non-financial enforcement is also significant: ordered deletions of data, bans on processing, ordered changes to products, public reprimands. The reputational impact of a public enforcement action often exceeds the fine. For the largest firms, an enforcement action is a major corporate event; for smaller firms, it can be existential. Compliance is not optional risk management; it is operational hygiene.

Transferring personal data outside the EU/EEA is restricted. GDPR allows transfers to 'adequate' jurisdictions (deemed to provide equivalent protection), to transfers with appropriate safeguards (standard contractual clauses, binding corporate rules), and, in limited cases, to transfers with specific consent or under derogations. The rules matter because so much data processing is global — cloud services, SaaS, offshore support — that cross-border transfers are routine, not exceptional.

The Schrems II decision (2020) invalidated the EU-US Privacy Shield, finding US surveillance law inadequate for EU data protection. The EU-US Data Privacy Framework (2023) replaced it with a new adequacy decision, conditional on US surveillance reforms. The framework restored a legal basis for EU-US transfers, but its robustness depends on the underlying US measures surviving challenge. The history (Safe Harbor invalidated, Privacy Shield invalidated) counsels against complacency.

The operational implication is that organisations must assess their transfer mechanisms continuously, not set them once. Standard contractual clauses (the default mechanism for non-adequate jurisdictions) require a transfer impact assessment — does the destination's law undermine the contractual safeguards? — and supplementary measures where it does. The due diligence is real, and the risk of a transfer mechanism being invalidated (as Privacy Shield was) is a live operational risk.

GDPR triggered a global privacy-law wave. Brazil's LGPD (2020), California's CCPA/CPRA (2020/2023), China's PIPL (2021), and many others follow GDPR's template with local variations. India's Digital Personal Data Protection Act 2023 is the most significant recent addition, bringing the world's largest population under a comprehensive privacy regime — with consent as the primary basis, data fiduciary obligations, data principal rights, and a Data Protection Board for enforcement.

The DPDP Act differs from GDPR in important ways: consent is the primary (near-exclusive) basis; the obligations are framed around 'data fiduciaries'; there are special provisions for children's data; and significant data fiduciaries face heightened obligations. The penalties are substantial (up to ₹250 crore per instance). India's regime is less prescriptive than GDPR in some areas and more in others, and its implementing rules are still being finalised — making early compliance planning important.

For multinationals, the implication is that privacy compliance is now a multi-regime programme, not a GDPR-only one. The efficient strategy is a GDPR-level baseline (which largely complies elsewhere) plus local adjustments for the variations (consent requirements, children's data, transfer rules, registration). The organisations that build a privacy programme around principles, not around one regulation, adapt to new regimes faster than those that built for GDPR alone and must rebuild for each new law.