GDPR — General Data Protection Regulation — Compliance brief

Record: General Data Protection Regulation (Regulation (EU) 2016/679)
Issuing body / enforcer: EU legislature; enforcement by Member State supervisory authorities (DPAs), coordinated by the European Data Protection Board (EDPB); Irish Data Protection Commission (DPC) is lead authority for most Big Tech via the one-stop-shop
Jurisdiction: European Economic Area (EU + EEA), with extraterritorial reach — applies to any organization processing personal data of people in the EU, regardless of where the organization is established (Art. 3)
Record type / importance: regulation / flagship
Last verified: 2026-09-30

Covers Data/AI/ML record data-ai-ml-reg-002 and Software record software-cert-029.

What it is

The GDPR is the EU's comprehensive personal-data protection framework, in force since May 25, 2018. It sets the rules for lawful processing of personal data, data-subject rights, accountability obligations, cross-border transfers, and breach notification. For engineering teams it is effectively the global reference standard for privacy-by-design — most non-EU privacy regimes (California CCPA/CPRA, Brazil LGPD) are downstream of it.

Scope: who it applies to, triggers, thresholds

Controllers (decide purposes/means) and processors (act on instructions) established in the EEA; plus non-EEA organizations that (a) offer goods/services to people in the EU or (b) monitor their behavior (Art. 3(2)) — a US SaaS vendor with EU customers is in scope without an EU office.
Trigger: any operation on personal data — collection, storage, transmission, analytics, ML training, logging.
Thresholds: most obligations are universal (no de minimis), but specific duties scale: DPO appointment is mandatory for public bodies, large-scale systematic monitoring, or large-scale processing of special-category data (Art. 37); Records of Processing Activities (Art. 30) are required of everyone except organizations under 250 employees doing only occasional, low-risk processing; DPIAs required for high-risk processing (Art. 35).

Key requirements and compliance obligations

Lawful basis (Art. 6): every processing activity needs one of six bases — consent, contract, legal obligation, vital interests, public task, legitimate interests. For AI/ML teams: legitimate interest requires a documented balancing test (LIA), and the EDPB's July 2026 Guidelines 03/2026 on web scraping confirm publicly available data still needs a lawful basis with case-by-case assessment.
Principles (Art. 5): lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, accountability — you must be able to demonstrate compliance.
Data-subject rights (Arts. 12–22): access, rectification, erasure, restriction, portability, objection, and — critical for ML systems — Art. 22 protection against solely automated decision-making with significant effects, including a right to human review and to contest the decision.
DPIAs (Art. 35): mandatory before high-risk processing; must describe the processing, assess necessity/proportionality, identify risks, and document mitigations. Consult the DPA beforehand if residual risk stays high.
Breach notification (Arts. 33–34): 72 hours to the supervisory authority after becoming aware; communicate to affected individuals without undue delay if high risk.
DPO, Art. 30 records, processor contracts (Art. 28), transfer mechanisms (Arts. 44–49): EU→third-country transfers need adequacy, SCCs, or derogations; the post-Privacy-Shield landscape remains enforcement-heavy.
Privacy by design and by default (Art. 25): build minimization, pseudonymisation, and retention policies into the product — this is where software engineers own the obligation directly.

Penalties and consequences

Tier 1: up to €10 million or 2% of worldwide annual turnover (e.g., Art. 25, 30, 35 violations).
Tier 2: up to €20 million or 4% of worldwide annual turnover, whichever is higher (e.g., principles, rights, lawful basis, transfer violations).
Cumulative fines exceeded €7.1 billion across 2,685+ decisions since 2018 (DLA Piper survey, Jan 2026; CMS tracker, Mar 2026); ~€1.2 billion was issued in 2025 alone. One caution: roughly 40% of the €7.1B by value has been annulled or is under challenge (Alliance Risk, May 2026) — headline numbers overstate settled outcomes, but enforcement is still accelerating in volume.

Version/edition status and live changes (verified 2026-09-30)

The Regulation itself is unchanged since 2018; change is happening in enforcement posture and guidance, not the text.
Digital Omnibus (Nov 2025 proposal): the Commission proposed GDPR simplifications (e.g., recalibrated DMA–GDPR consent interplay under joint EDPB–Commission guidelines from the 2025 annual report). As of Sept 2026 this remains a proposal — do not treat it as law.
Current enforcement posture (2026): the EDPB's 2026 Coordinated Enforcement Framework action (launched March 19, 2026, 25 DPAs participating) targets transparency obligations (Arts. 12–14) — website privacy disclosures, cookie banners, forms, analytics notices. This is the live risk for software products.
Automated decision-making is the hot target: the Dutch AP fined Uber €824.99 million in August 2026 — the second-largest GDPR fine ever — for solely automated driver deactivations without meaningful human review (Art. 22). For AI teams, Art. 22 compliance (human-in-the-loop, logic disclosure, contestation channels) is now the most expensive failure mode.
Guidance pipeline: EDPB Guidelines 02/2026 on anonymisation (draft July 2026, consultation through Oct 30, 2026) will replace WP29 Opinion 05/2014 once final — relevant to anyone training models on "anonymised" data.
For software teams, note the enforcement overlap with the EU AI Act (Art. 50 transparency duties in force since Aug 2026) and the CRA (Sept 2026 reporting): a product incident can now trigger GDPR breach-notification, AI Act, and CRA reporting clocks simultaneously.

Software: CISSP (software-cert-010) — its Security and Risk Management / Software Development Security domains test GDPR-era privacy requirements and data protection.
Data/AI/ML: the AWS/Google/Azure ML and data-engineering certs (data-ai-ml-cert-001/005/006/007/009/010/012/014) test data governance and responsible-AI content that presupposes GDPR concepts; none is a GDPR credential per se.

Honest flags

Fine statistics (€7.1B, €1.2B in 2025) come from law-firm surveys (DLA Piper, CMS) and industry trackers, not official EU statistics — directionally reliable, precise figures are estimates. The Uber €824.99M fine (Aug 21, 2026) is reported by AP coverage and compliance trackers; Uber is appealing, so treat as a regulator decision, not a settled judgment.
The Digital Omnibus GDPR changes are proposals; any claim that GDPR "will be simplified" in 2027 is speculative.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.

GDPR — General Data Protection Regulation