General Data Protection Regulation - Revision history

Tracerneo: link

2026-05-14T01:31:19Z

link

← Older revision		Revision as of 01:31, 14 May 2026
Line 1:		Line 1:
	The '''{{Wplink\|General Data Protection Regulation}}''' (GDPR) is the European Union's comprehensive data privacy and security law that went into effect on May 25, 2018.<ref>[https://gdpr.eu/what-is-gdpr/ "What is GDPR, the EU’s new data protection law?"] - gdpr.eu - 25 May 2018 ([http://web.archive.org/web/20260128031436/https://gdpr.eu/what-is-gdpr/ Archived])</ref> The regulation applies to any organization worldwide that processes data related to EU residents, regardless of the organization's location. It represents the world's most stringent approach to data protection, with potential fines for violations reaching up to €20 million or 4% of global revenue, whichever is higher.		The '''{{Wplink\|General Data Protection Regulation}}''' (GDPR) is the [[European Union]]'s comprehensive data privacy and security law that went into effect on May 25, 2018.<ref>[https://gdpr.eu/what-is-gdpr/ "What is GDPR, the EU’s new data protection law?"] - gdpr.eu - 25 May 2018 ([http://web.archive.org/web/20260128031436/https://gdpr.eu/what-is-gdpr/ Archived])</ref> The regulation applies to any organization worldwide that processes data related to EU residents, regardless of the organization's location. It represents the world's most stringent approach to data protection, with potential fines for violations reaching up to €20 million or 4% of global revenue, whichever is higher.

	The regulation mandates several key requirements for organizations processing EU residents' personal data. These include obtaining explicit consent for data collection, ensuring data minimization and purpose limitation, implementing appropriate security measures, and honoring individuals' rights regarding their personal data. Organizations must also maintain detailed documentation of their data processing activities, report data breaches within 72 hours, and in some cases appoint Data Protection Officers. The regulation defines personal data broadly, encompassing everything from basic identifiers like names and email addresses to more complex data like location information, biometric data, and online identifiers.		The regulation mandates several key requirements for organizations processing EU residents' personal data. These include obtaining explicit consent for data collection, ensuring data minimization and purpose limitation, implementing appropriate security measures, and honoring individuals' rights regarding their personal data. Organizations must also maintain detailed documentation of their data processing activities, report data breaches within 72 hours, and in some cases appoint Data Protection Officers. The regulation defines personal data broadly, encompassing everything from basic identifiers like names and email addresses to more complex data like location information, biometric data, and online identifiers.

Bananabot: Added archive URLs for 6 citation(s) using CRWCitationBot

2026-02-23T05:06:55Z

Added archive URLs for 6 citation(s) using CRWCitationBot

← Older revision		Revision as of 05:06, 23 February 2026
Line 1:		Line 1:
	The '''{{Wplink\|General Data Protection Regulation}}''' (GDPR) is the European Union's comprehensive data privacy and security law that went into effect on May 25, 2018.<ref>[https://gdpr.eu/what-is-gdpr/ "What is GDPR, the EU’s new data protection law?"] - gdpr.eu - 25 May 2018</ref> The regulation applies to any organization worldwide that processes data related to EU residents, regardless of the organization's location. It represents the world's most stringent approach to data protection, with potential fines for violations reaching up to €20 million or 4% of global revenue, whichever is higher.		The '''{{Wplink\|General Data Protection Regulation}}''' (GDPR) is the European Union's comprehensive data privacy and security law that went into effect on May 25, 2018.<ref>[https://gdpr.eu/what-is-gdpr/ "What is GDPR, the EU’s new data protection law?"] - gdpr.eu - 25 May 2018 ([http://web.archive.org/web/20260128031436/https://gdpr.eu/what-is-gdpr/ Archived])</ref> The regulation applies to any organization worldwide that processes data related to EU residents, regardless of the organization's location. It represents the world's most stringent approach to data protection, with potential fines for violations reaching up to €20 million or 4% of global revenue, whichever is higher.

	The regulation mandates several key requirements for organizations processing EU residents' personal data. These include obtaining explicit consent for data collection, ensuring data minimization and purpose limitation, implementing appropriate security measures, and honoring individuals' rights regarding their personal data. Organizations must also maintain detailed documentation of their data processing activities, report data breaches within 72 hours, and in some cases appoint Data Protection Officers. The regulation defines personal data broadly, encompassing everything from basic identifiers like names and email addresses to more complex data like location information, biometric data, and online identifiers.		The regulation mandates several key requirements for organizations processing EU residents' personal data. These include obtaining explicit consent for data collection, ensuring data minimization and purpose limitation, implementing appropriate security measures, and honoring individuals' rights regarding their personal data. Organizations must also maintain detailed documentation of their data processing activities, report data breaches within 72 hours, and in some cases appoint Data Protection Officers. The regulation defines personal data broadly, encompassing everything from basic identifiers like names and email addresses to more complex data like location information, biometric data, and online identifiers.
Line 5:		Line 5:
	The GDPR has established a new global standard for data protection by codifying several fundamental principles, including transparency, accountability, and privacy by design. Organizations must not only comply with these principles but also be able to demonstrate their compliance through documentation and organizational measures. This comprehensive approach to data protection reflects the EU's position that privacy is a fundamental human right, building upon the privacy protections first established in the 1950 European Convention on Human Rights and updated for the digital age.		The GDPR has established a new global standard for data protection by codifying several fundamental principles, including transparency, accountability, and privacy by design. Organizations must not only comply with these principles but also be able to demonstrate their compliance through documentation and organizational measures. This comprehensive approach to data protection reflects the EU's position that privacy is a fundamental human right, building upon the privacy protections first established in the 1950 European Convention on Human Rights and updated for the digital age.

	The United Kingdom still enforces the GDPR,<ref>https://ico.org.uk/for-organisations/data-protection-and-the-eu/data-protection-and-the-eu-in-detail/the-uk-gdpr/</ref> allowing persons physically located within the UK the ability to request data exports and deletions from online services.<ref>https://www.vpaa.uillinois.edu/resources/policies/u_of_i_system_and_international_privacy_laws/the_eu_and_uk_general_data_protection_regulations</ref>		The United Kingdom still enforces the GDPR,<ref>https://ico.org.uk/for-organisations/data-protection-and-the-eu/data-protection-and-the-eu-in-detail/the-uk-gdpr/ ([http://web.archive.org/web/20251230025316/https://ico.org.uk/for-organisations/data-protection-and-the-eu/data-protection-and-the-eu-in-detail/the-uk-gdpr/ Archived])</ref> allowing persons physically located within the UK the ability to request data exports and deletions from online services.<ref>https://www.vpaa.uillinois.edu/resources/policies/u_of_i_system_and_international_privacy_laws/the_eu_and_uk_general_data_protection_regulations ([http://web.archive.org/web/20251213031910/https://www.vpaa.uillinois.edu/resources/policies/u_of_i_system_and_international_privacy_laws/the_eu_and_uk_general_data_protection_regulations Archived])</ref>

	==Summary==		==Summary==
Line 11:		Line 11:
	===Chapter 2: Principles===		===Chapter 2: Principles===

	Chapter 2 of the GDPR addresses personal data, legal ways to process it, and consent of the user.<ref>[https://gdpr-info.eu/chapter-2/ "Chapter 2: Principles"] - gdpr-info.eu - 25 May 2018</ref>		Chapter 2 of the GDPR addresses personal data, legal ways to process it, and consent of the user.<ref>[https://gdpr-info.eu/chapter-2/ "Chapter 2: Principles"] - gdpr-info.eu - 25 May 2018 ([http://web.archive.org/web/20260117095156/https://gdpr-info.eu/chapter-2/ Archived])</ref>

	====Article 5: Principles relating to processing of personal data====		====Article 5: Principles relating to processing of personal data====
Line 29:		Line 29:
	===Chapter 3: Rights of the data subject===		===Chapter 3: Rights of the data subject===

	Chapter 3 of the GDPR covers transparency, information and access to personal data, the right to change, erase, or restrict processing of personal data, and the right to object.<ref>[https://gdpr-info.eu/chapter-3/ "Chapter 3: Rights of the data subject"] - gdpr-info.eu - 25 May 2018</ref>		Chapter 3 of the GDPR covers transparency, information and access to personal data, the right to change, erase, or restrict processing of personal data, and the right to object.<ref>[https://gdpr-info.eu/chapter-3/ "Chapter 3: Rights of the data subject"] - gdpr-info.eu - 25 May 2018 ([http://web.archive.org/web/20260117095030/https://gdpr-info.eu/chapter-3/ Archived])</ref>

	====Article 17: Right to erasure (‘right to be forgotten’)====		====Article 17: Right to erasure (‘right to be forgotten’)====
Line 52:		Line 52:

	===Chapter 4: Controller and processor===		===Chapter 4: Controller and processor===
	Chapter 4 of the GDPR covers general obligations of controllers and processors of data, their security, impact assessments and responsibility.<ref>[https://gdpr-info.eu/chapter-4/ "Chapter 4: Controller and processor"] - gdpr-info.eu - 25 May 2018</ref>		Chapter 4 of the GDPR covers general obligations of controllers and processors of data, their security, impact assessments and responsibility.<ref>[https://gdpr-info.eu/chapter-4/ "Chapter 4: Controller and processor"] - gdpr-info.eu - 25 May 2018 ([http://web.archive.org/web/20260117095128/https://gdpr-info.eu/chapter-4/ Archived])</ref>

	====Article 28: Processor====		====Article 28: Processor====

Raster: /* Article 17: Right to erasure (‘right to be forgotten’) */ fix spelling

2026-02-04T11:31:36Z

Article 17: Right to erasure (‘right to be forgotten’): fix spelling

← Older revision		Revision as of 11:31, 4 February 2026
Line 34:		Line 34:
	''Main wiki: [https://gdprhub.eu/index.php?title=Article_17_GDPR Article 17 GDPR]''		''Main wiki: [https://gdprhub.eu/index.php?title=Article_17_GDPR Article 17 GDPR]''

	Data subjects have the right to request erasure of their personal data by the data processor and the data processor is required to erase said data in a timely manner. This includes unnecessarily stored data, unlawfully processed data, and ~~publically availabe~~ information.		Data subjects have the right to request erasure of their personal data by the data processor and the data processor is required to erase said data in a timely manner. This includes unnecessarily stored data, unlawfully processed data, and publicly available information.

	This article does not cover free of expression and information, public interest, archiving purposes, or legally-relevant information.		This article does not cover free of expression and information, public interest, archiving purposes, or legally-relevant information.

2A00:23C8:2384:101:E65D:E107:D7AB:5C1E: added link to Digital Omnibus - weakens gdpr

2025-11-21T17:12:08Z

added link to Digital Omnibus - weakens gdpr

← Older revision		Revision as of 17:12, 21 November 2025
Line 60:		Line 60:

	==See also==		==See also==

	*[[Consent-or-pay]]		*[[Consent-or-pay]]
			*[[Digital Omnibus]]
	*https://gdprhub.eu, a wiki summarizing GDPR-related decisions by authorities and courts across Europe		*https://gdprhub.eu, a wiki summarizing GDPR-related decisions by authorities and courts across Europe

Sojourna: change raw to use wplink template

2025-10-14T21:47:29Z

change raw to use wplink template

← Older revision		Revision as of 21:47, 14 October 2025
Line 1:		Line 1:
	The '''~~[[wikipedia:General_Data_Protection_Regulation~~\|General Data Protection Regulation]]''' (GDPR) is the European Union's comprehensive data privacy and security law that went into effect on May 25, 2018.<ref>[https://gdpr.eu/what-is-gdpr/ "What is GDPR, the EU’s new data protection law?"] - gdpr.eu - 25 May 2018</ref> The regulation applies to any organization worldwide that processes data related to EU residents, regardless of the organization's location. It represents the world's most stringent approach to data protection, with potential fines for violations reaching up to €20 million or 4% of global revenue, whichever is higher.		The '''{{Wplink\|General Data Protection Regulation}}''' (GDPR) is the European Union's comprehensive data privacy and security law that went into effect on May 25, 2018.<ref>[https://gdpr.eu/what-is-gdpr/ "What is GDPR, the EU’s new data protection law?"] - gdpr.eu - 25 May 2018</ref> The regulation applies to any organization worldwide that processes data related to EU residents, regardless of the organization's location. It represents the world's most stringent approach to data protection, with potential fines for violations reaching up to €20 million or 4% of global revenue, whichever is higher.

	The regulation mandates several key requirements for organizations processing EU residents' personal data. These include obtaining explicit consent for data collection, ensuring data minimization and purpose limitation, implementing appropriate security measures, and honoring individuals' rights regarding their personal data. Organizations must also maintain detailed documentation of their data processing activities, report data breaches within 72 hours, and in some cases appoint Data Protection Officers. The regulation defines personal data broadly, encompassing everything from basic identifiers like names and email addresses to more complex data like location information, biometric data, and online identifiers.		The regulation mandates several key requirements for organizations processing EU residents' personal data. These include obtaining explicit consent for data collection, ensuring data minimization and purpose limitation, implementing appropriate security measures, and honoring individuals' rights regarding their personal data. Organizations must also maintain detailed documentation of their data processing activities, report data breaches within 72 hours, and in some cases appoint Data Protection Officers. The regulation defines personal data broadly, encompassing everything from basic identifiers like names and email addresses to more complex data like location information, biometric data, and online identifiers.

Beanie Bo: Removed common terms category. Added pro-consumer category

2025-09-21T22:38:46Z

Removed common terms category. Added pro-consumer category

← Older revision		Revision as of 22:38, 21 September 2025
Line 67:		Line 67:
	<references />		<references />

	[[Category:~~Common terms~~]]		[[Category:Pro-consumer articles]]
	[[Category:Legislation]]		[[Category:Legislation]]
	[[Category:EU legislation]]		[[Category:EU legislation]]

Beanie Bo: removed consent or pay section, left it under See Also

2025-09-20T16:53:14Z

removed consent or pay section, left it under See Also

← Older revision		Revision as of 16:53, 20 September 2025
Line 58:		Line 58:

	Outsourcing data processing to service providers is no excuse not to comply with GDPR, it is still up to the controller to ensure that the GDPR is complied with.		Outsourcing data processing to service providers is no excuse not to comply with GDPR, it is still up to the controller to ensure that the GDPR is complied with.

	~~==Consent-or-pay==~~
	~~''Main article: [[Consent-or-pay]]''~~

	In response to the GDPR's demand for transparency in data collection, some companies have began a new practice in which viewers may enter the company's website either by accepting all cookies or by paying a monthly fee to protect their privacy. Although the fee's purpose is to offset the lost revenue from cookie rejection, it has been considered coercive and predatory by some, including policymakers, and Meta has been investigated and fined in 2024 for this practice.

	~~It is unclear how the European Commission will continue to handle the consent-or-pay practice in the future.~~

	==See also==		==See also==

Beanie Bo: minor word change

2025-08-27T17:43:27Z

minor word change

← Older revision		Revision as of 17:43, 27 August 2025
Line 59:		Line 59:
	Outsourcing data processing to service providers is no excuse not to comply with GDPR, it is still up to the controller to ensure that the GDPR is complied with.		Outsourcing data processing to service providers is no excuse not to comply with GDPR, it is still up to the controller to ensure that the GDPR is complied with.

	== Consent-or-pay ==		==Consent-or-pay==
	''Main ~~wiki~~: [[Consent-or-pay]]''		''Main article: [[Consent-or-pay]]''

	In response to the GDPR's demand for transparency in data collection, some companies have began a new practice in which viewers may enter the company's website either by accepting all cookies or by paying a monthly fee to protect their privacy. Although the fee's purpose is to offset the lost revenue from cookie rejection, it has been considered coercive and predatory by some, including policymakers, and Meta has been investigated and fined in 2024 for this practice.		In response to the GDPR's demand for transparency in data collection, some companies have began a new practice in which viewers may enter the company's website either by accepting all cookies or by paying a monthly fee to protect their privacy. Although the fee's purpose is to offset the lost revenue from cookie rejection, it has been considered coercive and predatory by some, including policymakers, and Meta has been investigated and fined in 2024 for this practice.

Beanie Bo: added consent-or-pay section; will add appropriate citations & sources after working on the main wiki

2025-08-26T01:41:21Z

added consent-or-pay section; will add appropriate citations & sources after working on the main wiki

← Older revision		Revision as of 01:41, 26 August 2025
Line 58:		Line 58:

	Outsourcing data processing to service providers is no excuse not to comply with GDPR, it is still up to the controller to ensure that the GDPR is complied with.		Outsourcing data processing to service providers is no excuse not to comply with GDPR, it is still up to the controller to ensure that the GDPR is complied with.

			== Consent-or-pay ==
			''Main wiki: [[Consent-or-pay]]''

			In response to the GDPR's demand for transparency in data collection, some companies have began a new practice in which viewers may enter the company's website either by accepting all cookies or by paying a monthly fee to protect their privacy. Although the fee's purpose is to offset the lost revenue from cookie rejection, it has been considered coercive and predatory by some, including policymakers, and Meta has been investigated and fined in 2024 for this practice.

			It is unclear how the European Commission will continue to handle the consent-or-pay practice in the future.

	==See also==		==See also==

			*[[Consent-or-pay]]
	*https://gdprhub.eu, a wiki summarizing GDPR-related decisions by authorities and courts across Europe		*https://gdprhub.eu, a wiki summarizing GDPR-related decisions by authorities and courts across Europe
	*[[Consent-or-pay]]

	==References==		==References==

Beanie Bo: /* See also */

2025-08-25T17:11:02Z

← Older revision		Revision as of 17:11, 25 August 2025
Line 51:		Line 51:
	When automated decisions are made under contractual necessity or explicit consent, the data controller must implement safeguards including human intervention options, allowing individuals to express their views and contest decisions. Automated decisions cannot be based on special categories of personal data (such as race, health data, or political opinions) unless specific conditions are met and appropriate safeguards are in place.		When automated decisions are made under contractual necessity or explicit consent, the data controller must implement safeguards including human intervention options, allowing individuals to express their views and contest decisions. Automated decisions cannot be based on special categories of personal data (such as race, health data, or political opinions) unless specific conditions are met and appropriate safeguards are in place.

	=== Chapter 4: Controller and processor ===		===Chapter 4: Controller and processor===
	Chapter 4 of the GDPR covers general obligations of controllers and processors of data, their security, impact assessments and responsibility.<ref>[https://gdpr-info.eu/chapter-4/ "Chapter 4: Controller and processor"] - gdpr-info.eu - 25 May 2018</ref>		Chapter 4 of the GDPR covers general obligations of controllers and processors of data, their security, impact assessments and responsibility.<ref>[https://gdpr-info.eu/chapter-4/ "Chapter 4: Controller and processor"] - gdpr-info.eu - 25 May 2018</ref>

	==== Article 28: Processor ====		====Article 28: Processor====
	''Main wiki: [https://gdprhub.eu/index.php?title=Article_28_GDPR Article 28 GDPR]''		''Main wiki: [https://gdprhub.eu/index.php?title=Article_28_GDPR Article 28 GDPR]''

Line 62:		Line 62:

	*https://gdprhub.eu, a wiki summarizing GDPR-related decisions by authorities and courts across Europe		*https://gdprhub.eu, a wiki summarizing GDPR-related decisions by authorities and courts across Europe
			*[[Consent-or-pay]]

	==References==		==References==