GDPR & Data Protection

Who is subject to the GDPR?

The General Data Protection Regulation applies to every natural or legal person who, as a controller within the meaning of Article 4(7) GDPR, determines the purposes and means of processing personal data, as well as to processors as defined in Article 4(8) GDPR. Establishment within the Union is not the only trigger: through the market-location principle set out in Article 3(2) GDPR, the Regulation reaches extraterritorially and also covers providers from third countries where they offer goods or services to data subjects in the EU or monitor their behaviour within the Union. For DACH SMEs operating webshops, using cloud services or working with international partners, the personal scope of the Regulation is virtually always engaged.

The 4 mandatory pillars of GDPR compliance

The operational implementation of the Regulation rests on four binding pillars. First, the accountability obligation under Article 5(2) GDPR, which requires documented evidence of compliance with all principles laid down in Article 5(1) GDPR. Second, the data subject rights under Articles 12 to 22 GDPR — access, rectification, erasure, restriction, data portability and objection. Third, the technical and organisational measures under Article 32 GDPR, by which organisations must ensure a level of security appropriate to the risk. Fourth, the notification duties under Articles 33 and 34 GDPR for personal data breaches towards the supervisory authority and, where applicable, towards the data subjects affected.

Where to start?

The pillar article GDPR guide sets out the Regulation systematically and provides the framework for the deeper dives that follow. Four knowledge articles cover the most common entry questions: the data processing agreement under Article 28 GDPR for every service-provider relationship, the TOM checklist for Article 32 GDPR as the basis of the appropriate level of security, the 72-hour data breach notification procedure, and the assessment When is a data protection officer mandatory? under Article 37 GDPR and Section 38 BDSG.