What does GDPR mean?

GDPR means General Data Protection Regulation, the EU law governing how organisations process personal data and the rights individuals have over that information. It has applied since 25 May 2018 and covers activities such as collecting customer details, managing employee records and using identifiable online tracking data.

In practice, organisations must establish a lawful basis for processing, collect only necessary information, protect it and respect individuals’ rights. Consent is one lawful basis, but it is not required for every processing activity.

Organisations must also explain their data practices clearly, often through a privacy policy, including why information is collected, how long it is kept and who receives it.