GDPR — the General Data Protection Regulation

The GDPR applies to the processing of personal data — any information that directly or indirectly relates to an identifiable living person (name, email address, IP address, customer ID, and so on). It covers both controllers (whoever determines the purposes and means of processing) and processors (whoever processes data on a controller's behalf).

Territorially (Article 3), it applies to organisations established in the EU, but also to companies outside the EU that offer goods or services to, or monitor the behaviour of, people in the EU.

• Lawfulness, fairness and transparency — process data lawfully and openly.
• Purpose limitation — collect data for specified, explicit purposes.
• Data minimisation — only what is actually needed.
• Accuracy — keep data correct and up to date.
• Storage limitation — keep data no longer than necessary.
• Integrity and confidentiality — protect data against unauthorised access.
• Accountability — be able to demonstrate compliance.

No processing without a lawful basis. The six bases are: consent, performance of a contract, legal obligation, protection of vital interests, a task carried out in the public interest and legitimate interests. Special categories of data (Article 9) additionally require a specific exemption.

Individuals have the right to, among other things, information, access (a subject access request), rectification, erasure ("the right to be forgotten"), restriction of processing, data portability and to object to processing — as well as protection against decisions based solely on automated processing (Article 22).

Depending on your operations, you may need: records of processing activities (Article 30), data processing agreements (Article 28), a data protection impact assessment (DPIA) where the risk is high (Article 35), a data protection officer (Article 37) and data protection by design and by default (Article 25). In the event of a breach: notify the supervisory authority — in Sweden, IMY (the Swedish Authority for Privacy Protection), within 72 hours — and inform affected individuals if the risk is high.

We build with data protection at the core: lawful bases and consent management in place, EU-based hosting, encryption, access control and clear documentation. Talk to us about privacy-first architecture →

This page is informational and fact-checked against the primary source, but it does not constitute legal advice. For a binding assessment of your specific organisation — talk to us or your legal counsel.