GDPR Overview: What Businesses Need to Know in 2026

A GDPR overview is the first step toward understanding how the European Union's data protection framework affects your business. The General Data Protection Regulation (Regulation 2016/679) governs how organizations collect, store, and use personal data of individuals in the European Economic Area, and it applies to businesses worldwide that interact with those individuals.

This guide breaks down the regulation's core principles, the rights it grants to individuals, your obligations as a data controller or processor, and the enforcement mechanisms that supervisory authorities use. The content here is educational and does not constitute legal advice. Consult a qualified attorney for guidance specific to your organization.

What Is the GDPR and Why It Matters

The General Data Protection Regulation is a comprehensive data protection law adopted by the European Union in April 2016 and enforceable since May 25, 2018. It replaced the earlier Data Protection Directive (95/46/EC) and established a single, unified framework for data protection across all EU member states.

The regulation matters for three reasons. First, it applies extraterritorially. Article 3 extends GDPR jurisdiction to any organization processing personal data of people in the EEA, even if the organization has no physical presence in Europe. Second, the penalties are substantial: up to 20 million EUR or 4% of annual global turnover for the most serious violations. Third, it has influenced data protection legislation worldwide, from Brazil's LGPD to California's CPRA, making GDPR knowledge transferable across jurisdictions.

For website operators, the GDPR affects everything from analytics tracking and cookie consent to contact forms and email marketing. If your website receives visitors from the EU, the regulation applies to you.

The Seven Core Principles of the GDPR

Article 5 of the GDPR establishes seven principles that govern all personal data processing. Every compliance decision you make should trace back to one or more of these principles.

1. Lawfulness, fairness, and transparency: Processing must have a legal basis, must not be deceptive, and must be explained clearly to data subjects.
2. Purpose limitation: Data collected for one stated purpose cannot be repurposed for something incompatible without a new legal basis.
3. Data minimization: Only collect the personal data you actually need. If you do not need a date of birth, do not ask for it.
4. Accuracy: Keep personal data correct and up to date. Provide mechanisms for individuals to request corrections.
5. Storage limitation: Retain personal data only for as long as necessary to fulfill the stated purpose, then delete or anonymize it.
6. Integrity and confidentiality: Protect personal data against unauthorized access, loss, or destruction using appropriate technical and organizational measures.
7. Accountability: The data controller must demonstrate compliance. It is not enough to follow the rules; you must be able to prove that you do.

These principles are not aspirational suggestions. Supervisory authorities evaluate compliance against them, and violations of Article 5 fall under the upper tier of penalties.

Lawful Bases for Processing Personal Data

Article 6 of the GDPR lists six lawful bases for processing personal data. You must identify and document a valid basis before you begin processing.

• Consent: The data subject has given clear, affirmative, informed consent for a specific purpose. Consent must be freely given, and the individual must be able to withdraw it as easily as they gave it.
• Contractual necessity: Processing is necessary to perform a contract with the data subject, such as processing a shipping address to deliver an order.
• Legal obligation: Processing is required to comply with a law, such as retaining financial records for tax purposes.
• Vital interests: Processing is necessary to protect someone's life. This basis is narrow and rarely applies to typical business operations.
• Public task: Processing is necessary for a task carried out in the public interest or in the exercise of official authority. This applies mainly to government bodies.
• Legitimate interests: Processing is necessary for the legitimate interests of the controller or a third party, provided those interests are not overridden by the data subject's rights. This requires a documented balancing test.

For most website operators, consent and legitimate interests are the most commonly relied upon bases. Cookie consent, for example, requires explicit opt-in consent under the ePrivacy Directive for non-essential cookies, with the GDPR providing the framework for how that consent is obtained and recorded.

GDPR Overview of Individual Rights

The GDPR grants individuals eight specific rights over their personal data. These rights are detailed in Chapter III (Articles 12 through 23) and must be addressed within one month of receiving a request, with a possible two-month extension for complex cases.

Right of Access (Article 15)

Individuals can request confirmation of whether you process their data, and if so, a copy of that data along with details about the processing purposes, categories of data, recipients, and retention periods.

Right to Rectification (Article 16)

Individuals can request correction of inaccurate personal data or completion of incomplete data.

Right to Erasure (Article 17)

Also known as the "right to be forgotten," this allows individuals to request deletion of their personal data when it is no longer necessary, when consent is withdrawn, or when processing was unlawful. Exceptions exist for legal obligations and public interest purposes.

Right to Restriction of Processing (Article 18)

Individuals can request that you limit processing of their data while disputes about accuracy or lawfulness are resolved.

Right to Data Portability (Article 20)

Where processing is based on consent or contract and carried out by automated means, individuals can request their data in a structured, commonly used, machine-readable format and have it transmitted to another controller.

Right to Object (Article 21)

Individuals can object to processing based on legitimate interests or public task grounds. For direct marketing purposes, the right to object is absolute.

Rights Related to Automated Decision-Making (Article 22)

Individuals have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects, subject to certain exceptions.

Organizations that collect personal data through their websites need a clear privacy policy that explains these rights and provides a mechanism for individuals to exercise them.

Obligations for Data Controllers and Processors

The GDPR distinguishes between data controllers (who determine why and how data is processed) and data processors (who process data on behalf of controllers). Both have specific obligations.

Controller Obligations

• Privacy by design and default (Article 25): Build data protection into systems from the start, and ensure the default settings are the most privacy-protective.
• Records of processing activities (Article 30): Maintain a written record of all processing activities, including purposes, data categories, recipients, transfers, and retention periods.
• Data Protection Impact Assessments (Article 35): Conduct a DPIA before any processing that is likely to result in high risk to individuals, such as large-scale profiling or systematic monitoring.
• Data breach notification (Articles 33 and 34): Notify the relevant supervisory authority within 72 hours of becoming aware of a breach involving personal data. If the breach poses a high risk to individuals, notify them directly.
• Data Protection Officer (Articles 37 through 39): Appoint a DPO if your core activities involve large-scale monitoring of individuals or large-scale processing of special categories of data.

Processor Obligations

• Process data only on documented instructions from the controller.
• Implement appropriate security measures.
• Assist the controller with data subject requests and breach notifications.
• Submit to audits by the controller.
• Enter into a written data processing agreement (Article 28).

A properly drafted privacy policy is a critical part of meeting transparency obligations. TermsBox offers a privacy policy generator that produces policies aligned with GDPR disclosure requirements, covering lawful bases, data subject rights, and third-party data sharing.

International Data Transfers Under the GDPR

Chapter V of the GDPR (Articles 44 through 50) restricts transfers of personal data to countries outside the EEA unless adequate protections are in place.

The primary mechanisms for lawful international transfers include:

• Adequacy decisions (Article 45): The European Commission has recognized certain countries as providing adequate data protection, including the United Kingdom, Japan, South Korea, and (as of the EU-US Data Privacy Framework) the United States for certified organizations.
• Standard Contractual Clauses (Article 46): Pre-approved contractual templates adopted by the European Commission that bind the data importer to GDPR-equivalent protections.
• Binding Corporate Rules (Article 47): Internal policies approved by supervisory authorities for intra-group transfers within multinational organizations.
• Derogations (Article 49): Narrow exceptions for specific situations, such as explicit consent, contractual necessity, or important reasons of public interest.

Following the Schrems II ruling (Case C-311/18), organizations using SCCs must also conduct a Transfer Impact Assessment to evaluate whether the destination country's laws provide adequate protection in practice, and implement supplementary measures if they do not.

GDPR Enforcement and Penalties

GDPR enforcement is carried out by independent supervisory authorities in each EU member state, coordinated through the European Data Protection Board (EDPB). The regulation established a two-tier penalty structure.

Lower tier (Article 83(4)): Fines of up to 10 million EUR or 2% of annual global turnover for violations related to:

• Controllers and processors (Articles 8, 11, 25 through 39, 42, 43)
• Certification bodies (Articles 42, 43)
• Monitoring bodies (Article 41)

Upper tier (Article 83(5)): Fines of up to 20 million EUR or 4% of annual global turnover for violations related to:

• Processing principles and lawful bases (Articles 5, 6, 7, 9)
• Data subject rights (Articles 12 through 22)
• International transfers (Articles 44 through 49)
• Non-compliance with supervisory authority orders

Notable enforcement actions illustrate the scale of penalties in practice:

• Meta (Ireland, 2023): 1.2 billion EUR for unlawful data transfers to the United States.
• Amazon (Luxembourg, 2021): 746 million EUR for processing personal data without proper consent.
• Google (France, 2022): 150 million EUR for cookie consent violations.

Beyond fines, supervisory authorities can issue orders to stop processing, require data deletion, or suspend data flows to third countries. For smaller organizations, a processing ban can be more damaging than a financial penalty.

Practical Steps for GDPR Compliance

Achieving GDPR compliance is an ongoing process, not a one-time project. These steps provide a practical starting point for website operators.

1. Map your data processing: Document what personal data you collect, where it comes from, why you process it, who you share it with, and how long you keep it.
2. Identify your lawful bases: For each processing activity, determine and record which of the six lawful bases under Article 6 applies.
3. Update your privacy policy: Ensure your policy covers all GDPR-required disclosures, including data subject rights, lawful bases, retention periods, and international transfers.
4. Implement cookie consent: Deploy a consent management platform that obtains opt-in consent before setting non-essential cookies, and records that consent as evidence of compliance.
5. Establish data subject request procedures: Create a process for receiving, verifying, and responding to access, deletion, and other rights requests within the one-month deadline.
6. Review third-party contracts: Ensure all data processors have signed Data Processing Agreements that meet Article 28 requirements.
7. Conduct a security review: Implement appropriate technical measures such as encryption, access controls, and regular vulnerability assessments.
8. Train your team: Ensure employees who handle personal data understand their obligations and know how to escalate data protection issues.

Compliance tools can reduce the manual burden significantly. A website compliance scanner can identify cookies and trackers automatically, while a cookie policy generator produces disclosures based on what the scan detects.

How GDPR Connects to Other Privacy Laws

The GDPR does not exist in isolation. Understanding how it relates to other privacy frameworks helps organizations build a compliance strategy that works across jurisdictions.

• UK GDPR: Nearly identical to the EU GDPR, retained in UK law after Brexit. The UK has its own supervisory authority (ICO) and separate adequacy decisions.
• CCPA/CPRA (California): Takes an opt-out approach rather than the GDPR's opt-in model. CCPA provides a right to know, delete, and opt out of the sale or sharing of personal information. Penalties range from $2,500 to $7,500 per intentional violation.
• LGPD (Brazil): Closely modeled on the GDPR with 10 lawful bases for processing, individual rights, and a dedicated enforcement authority (ANPD).
• POPIA (South Africa): Adopts GDPR-like principles with additional provisions for direct marketing and the processing of children's data.
• US state privacy laws: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and others have enacted GDPR-influenced legislation with varying requirements.

Organizations that comply with the GDPR typically find it straightforward to extend compliance to other jurisdictions, since the GDPR's requirements are among the most comprehensive globally.

Frequently Asked Questions

Who does the GDPR apply to?

The GDPR applies to any organization that processes personal data of individuals located in the European Economic Area, regardless of where the organization is based. A company in the United States running an online store that ships to EU customers must comply with the GDPR, just as a Berlin-based startup must. The regulation uses the concepts of 'establishment' in the EU and 'offering goods or services' to EU residents to determine its territorial reach under Article 3.

What are the penalties for GDPR non-compliance?

GDPR penalties are divided into two tiers. Lower-tier violations, such as failing to maintain processing records, can result in fines of up to 10 million EUR or 2% of annual global turnover, whichever is higher. Upper-tier violations, such as unlawful processing or ignoring data subject rights, carry fines of up to 20 million EUR or 4% of annual global turnover. Supervisory authorities also have the power to issue warnings, reprimands, and orders to cease processing.

What counts as personal data under the GDPR?

Personal data is any information that relates to an identified or identifiable natural person. This includes obvious identifiers like names and email addresses, but also IP addresses, cookie identifiers, location data, device fingerprints, and even pseudonymized data if it can be linked back to an individual. Article 4(1) of the GDPR defines the term broadly to capture any data that could directly or indirectly identify someone.

Do small businesses need to comply with the GDPR?

Yes. The GDPR does not include a blanket exemption based on company size. If your business processes personal data of individuals in the EEA, it must comply. However, some obligations scale with risk and volume. For example, Article 30(5) exempts organizations with fewer than 250 employees from certain record-keeping requirements, unless processing is likely to result in a risk to data subjects, is not occasional, or includes special categories of data.