General Data Protection Regulation (GDPR)
The GDPR is the European data protection law that governs how organisations collect and use personal data; in the UK it continues as the "UK GDPR" alongside the Data Protection Act 2018.
What is General Data Protection Regulation (GDPR)?
The GDPR sets out principles such as lawfulness, purpose limitation and data minimisation, and gives individuals rights including access to their data (Article 15) and erasure, the "right to be forgotten" (Article 17). Organisations must usually respond to such requests within one month. Fines can reach £17.5 million or 4% of global turnover in the UK. The ICO enforces it in the UK.