What Is GDPR? A Data Protection Compliance Guide for Businesses

You do not have to operate in Europe for GDPR to reach your business. If people in the EU can buy from your website, sign up for your newsletter, or simply get tracked by your analytics, the regulation can apply to you, no matter where your servers or your offices sit. That surprises a lot of American business owners, and it is exactly why GDPR matters far beyond the EU. This guide explains what GDPR actually is, who it covers, the core rules it sets, the rights it gives individuals, and what the penalties really look like, in plain English rather than legal code.

What’s in This Guide

What Is GDPR?

The General Data Protection Regulation is the European Union’s comprehensive law for protecting personal data and privacy. It was adopted by the European Parliament and Council in 2016 and became enforceable on 25 May 2018, replacing a patchwork of older national rules with a single standard that applies across every EU member state. You can read the full law in the official EU regulation text on EUR-Lex, and the European Data Protection Board’s official guidance explains how regulators interpret it.

At its heart, GDPR is about “personal data,” which it defines broadly as any information relating to an identifiable person. That is more than a name and email. It includes IP addresses, location data, device identifiers, cookies, and online behavior, so the regulation touches almost every company that runs a website or markets online. Whenever your business collects or uses that kind of information, GDPR calls the activity “processing,” and processing is only allowed when you have a valid legal reason for it.

A useful way to picture GDPR is as a set of rules of the road for personal data. It does not stop you from driving, in other words from using data to run and grow your business. What it does is set the speed limits, require a license, and hold you responsible if you cause harm. The regulation assumes the individual, not the company, ultimately owns their personal information, and that your business is only borrowing it under conditions the person can see and control. That single shift in ownership is what drives every rule that follows.

Source: Regulation (EU) 2016/679, EUR-Lex | European Data Protection Board

How GDPR Works: The Seven Principles

GDPR is long, but its core sits in seven principles that every use of personal data must satisfy. If you understand these, you understand what the regulation is actually asking for. They come directly from Article 5 of the law.

1. Lawfulness, fairness, and transparency. You need a valid legal basis to use personal data, you must not use it in ways that would surprise or mislead people, and you must tell them clearly what you are doing.
2. Purpose limitation. Collect data for a specific, stated reason and do not quietly reuse it for something unrelated later.
3. Data minimization. Only collect what you actually need for that purpose. Gathering data “just in case” is a violation, not a strategy.
4. Accuracy. Keep personal data correct and up to date, and fix or delete what is wrong.
5. Storage limitation. Do not keep data longer than you need it. This is where a documented data retention policy does real work.
6. Integrity and confidentiality. Protect data with appropriate security, including access controls and encryption, so it is not lost, stolen, or exposed.
7. Accountability. You must be able to prove you follow the other six. Under GDPR, doing the right thing is not enough if you cannot document it.

That last principle, accountability, is what trips up most businesses. GDPR does not just want you to be compliant; it wants you to hold the records, policies, and evidence that show you are compliant, because that is what a regulator asks for first. Good data governance is what produces that evidence as a byproduct of daily operations rather than a last-minute scramble.

Source: GDPR Article 5, principles of processing | UK Information Commissioner’s Office, data protection principles

Who GDPR Applies To

This is the question that matters most for a US business, and the answer is wider than most people expect. GDPR is not limited to companies headquartered in Europe. Its reach, defined in Article 3, follows the people it protects, not the location of the company. Your business can fall under GDPR in three common situations.

1. You have an establishment in the EU. An office, branch, or subsidiary in an EU country brings your data processing under GDPR.
2. You offer goods or services to people in the EU. Selling to EU customers, taking their orders, or marketing to them, even for free services, triggers the regulation, whether or not money changes hands.
3. You monitor the behavior of people in the EU. Tracking EU visitors with cookies, analytics, or advertising pixels counts as monitoring, which is why so many US websites are affected.

GDPR also splits responsibility between two roles. A data controller decides why and how personal data is used, and a data processor handles data on the controller’s behalf, such as a cloud provider or an email platform. If you run the business collecting the data, you are usually the controller and carry the primary legal responsibility, even when a vendor does the actual processing. That makes your vendor contracts part of your compliance.

Source: GDPR Article 3, territorial scope | European Commission, rules for business and organisations

GDPR vs. CCPA

GDPR is most often confused with the California Consumer Privacy Act, or CCPA, and its amendment the CPRA. Both are landmark privacy laws that give people rights over their data, and a business subject to one is often close to the other. But they are not the same, and treating GDPR like CCPA leaves real gaps. The biggest difference is the consent model: GDPR generally requires people to opt in before you use their data, while CCPA lets you use it unless they opt out.

The practical takeaway: GDPR is generally the higher bar. A business built to meet GDPR, with opt-in consent, documented purposes, and a way to honor individual rights, is usually well positioned for CCPA and the growing list of US state privacy laws. Building only to CCPA and assuming it covers Europe is the mistake that gets companies fined.

Source: California Attorney General, CCPA | General Data Protection Regulation, full text

The Eight Rights GDPR Gives Individuals

GDPR shifts control of personal data to the individual, and it does that through eight specific rights. For your business, these are not abstract, because you are legally required to have a process to honor each one, usually within one month of a request. Ignoring a request is itself a violation.

1. The right to be informed. People must be told what data you collect and why, typically through a clear privacy notice.
2. The right of access. Individuals can ask for a copy of the personal data you hold about them.
3. The right to rectification. They can have inaccurate data corrected.
4. The right to erasure. Often called the “right to be forgotten,” this lets people ask you to delete their data in certain circumstances.
5. The right to restrict processing. They can ask you to pause use of their data while a dispute is resolved.
6. The right to data portability. They can obtain their data in a usable format and move it to another provider.
7. The right to object. They can object to certain processing, including direct marketing, which you must then stop.
8. Rights related to automated decisions. People have protections against purely automated decisions and profiling that significantly affect them.

Behind each right sits a practical requirement: you have to be able to find a specific person’s data across every system you run. A business that cannot locate all copies of one customer’s information cannot honor an access or erasure request, which is why these rights push companies toward better data organization whether they intended to improve it or not.

Source: European Commission, rights of citizens | UK Information Commissioner’s Office, individual rights

GDPR Penalties and Fines

GDPR gets attention for one reason above all others: the size of its fines. The regulation uses a two-tier structure, and both tiers are calculated as the higher of a fixed cap or a percentage of the company’s global annual revenue, which is what makes them so serious for large businesses.

The lower tier, up to 10 million euros or 2% of global revenue, covers more procedural failures like poor record-keeping or not appointing a required data protection officer. The higher tier, up to 20 million euros or 4% of global revenue, covers the serious violations: ignoring the core principles, breaking the rules on consent, or violating individuals’ rights. Regulators also weigh how severe and how negligent the violation was when setting the actual figure.

These are not theoretical numbers. The largest single GDPR fine to date was issued in May 2023, when Ireland’s Data Protection Commission penalized Meta 1.2 billion euros over unlawful transfers of EU user data to the United States. Enforcement has also broadened well beyond big tech.

Across all of Europe, GDPR fines totaled roughly 5.88 billion euros between the law taking effect in 2018 and early 2025, with about 1.2 billion euros issued in the most recent survey year alone, according to law firm DLA Piper’s annual survey. Beyond the headline penalties, a serious violation often triggers a breach: under Article 33, a personal data breach must generally be reported to the regulator within 72 hours of discovery, a deadline that catches unprepared companies off guard. For a fuller picture of enforcement trends, see our cybersecurity compliance statistics.

Explore Managed Cybersecurity Services
See Backup and Recovery Options

Source: GDPR Article 83, conditions for imposing fines | Irish Data Protection Commission, Meta decision | DLA Piper GDPR Fines and Data Breach Survey, January 2025

How to Get Started With GDPR Compliance

You do not become GDPR compliant by buying a single tool or posting a privacy policy. It is a program that combines legal decisions, documented processes, and real technical controls. For a small or midsize business, a workable path follows five steps.

1. Map your data. Identify what personal data you collect, where it comes from, where it lives, and who has access. You cannot protect or honor rights over data you have not located, and this step alone usually surfaces surprises.
2. Establish a lawful basis. For each type of processing, decide which of GDPR’s six lawful bases applies, such as consent, a contract, or a legitimate interest, and record it.
3. Update notices and consent. Make your privacy notice clear and specific, and where you rely on consent, capture it as a genuine, opt-in choice rather than a pre-ticked box.
4. Build the security controls. Put appropriate protection behind the data, including access controls, encryption, and reliable backups, so a breach is both less likely and recoverable.
5. Document and assign ownership. Keep records of your processing, your decisions, and your response processes, and give one person or role clear accountability for keeping the program current.

The hardest part is rarely the technology. It is sustaining the accountability, which is why many businesses assign GDPR oversight to a CIO, an outsourced Virtual CIO, or a data protection lead who can translate the regulation into practical rules and keep them enforced. Pairing that leadership with a broader IT compliance program and a formal cybersecurity risk assessment gives you a prioritized starting point instead of a blank page. If GDPR is only one of several regulations you face, treating them together as a single governance effort is far more efficient than chasing each one separately.

Common Questions About GDPR

Related Terms

Get a Free Consultation

David McFarlene Founder & CEO

David McFarlene is the owner and founder of CNiC Solutions, a trusted IT services and cybersecurity company serving the Houston, TX area. With over 20 years of experience in managed IT, infrastructure design, cloud solutions, and data security, David helps businesses and homeowners stay protected and productive through dependable, personalized technology support. He leads the CNiC Solutions team with a focus on reliability, transparency, and long-term relationships, ensuring clients always have a knowledgeable expert they can trust.

See Full Bio

IT Services Network Cabling Cloud Solutions Cybersecurity Data Backup & Recovery Managed IT Services Infrastructure Management Telecommunications Virtual CIO (vCIO) WebRTC