What is the GDPR?
The General Data Protection Regulation (GDPR) is one of the world’s most powerful data privacy laws. Enforced by the European Union since May 2018, it gives individuals more control over their personal data and holds companies accountable for how they collect, use, and share that data.
But what does it mean for you, especially if you’re not living in Europe?
In this article, we break down the GDPR in simple terms what it is, how it protects you, and how you can use it to defend your digital privacy.
1. What is personal data?
According to GDPR, personal data is any information that can identify you, directly or indirectly. This includes:
-
Your name and address
-
Your email and IP address
-
Photos, videos, and voice recordings
-
Social media posts
-
GPS location
-
Even health, biometric, or financial data
If you’ve read What Companies Know About You, you’ll recognize how much personal data is floating out there and how it’s often used without your full awareness.
2. The core principles of GDPR
GDPR is built on seven key principles that companies must follow:
-
Lawfulness, fairness & transparency – They must be honest about what data they collect and why.
-
Purpose limitation – They can’t use your data for anything beyond the original purpose.
-
Data minimization – Only collect what’s necessary.
-
Accuracy – Data must be kept up to date.
-
Storage limitation – Data must not be kept longer than needed.
-
Integrity & confidentiality – Data must be protected with appropriate security.
-
Accountability – Companies must be able to prove compliance.
These rules apply to any organization even outside the EU if they process the data of EU citizens.
3. Your rights under GDPR
The most empowering part of the GDPR is the rights it gives you as a user:
a. The right to access
You can request a copy of all the data a company holds about you.
b. The right to be forgotten
You can ask for your data to be deleted.
c. The right to data portability
You can receive your data in a readable format and transfer it to another provider.
d. The right to restrict processing
You can limit how your data is used even without deleting it.
e. The right to object
You can refuse your data being used for direct marketing or profiling.
f. The right to be informed
You must be clearly told why and how your data is being collected.
These rights make it easier to take action, especially if you’re trying to protect your personal data online.
4. How can you use GDPR to protect yourself?
Even if you’re not in the EU, many companies comply with GDPR globally. Here’s how to take advantage of it:
Step 1: Find the Company’s Privacy Policy
Every website or app must display a privacy policy. Look for a section on GDPR or “Your Data Rights”.
Step 2: Send a Data Request
You can email their Data Protection Officer (DPO) or use a contact form to:
-
Ask for all personal data they’ve stored
-
Request deletion
-
Opt out of processing or marketing
Sample message:
“Under GDPR, I am requesting access to the personal data your company holds about me. Please also delete my data and confirm once this is complete.”
Step 3: Use data protection tools
Some tools help you send automatic GDPR requests:
5. What happens if companies don’t comply?
Companies that ignore GDPR face serious consequences:
-
Fines up to €20 million or 4% of global revenue
-
Public lawsuits
-
Brand reputation damage
That’s why most big tech companies Google, Meta, Apple, Amazon have changed their privacy practices (on paper, at least) since GDPR.
Fun fact: In 2023, Meta was fined €1.2 billion for violating GDPR by transferring European user data to the U.S.
6. Beyond GDPR: Other data privacy laws
GDPR was just the beginning. More laws are following its footsteps:
-
CCPA (California Consumer Privacy Act) Similar protections for California residents
-
PIPEDA (Canada)
-
LGPD (Brazil)
-
DPDP (India) Digital Personal Data Protection Bill
These laws signal a shift toward global privacy awareness, helping individuals everywhere take back control.
GDPR empowers you
The GDPR isn’t just a legal framework it’s a tool for digital self-defense. Whether you’re in Europe or not, its ripple effect is changing how companies treat your data.
When combined with smart habits like those in our guide to protecting personal data and awareness about what companies know, you can begin to reclaim your online freedom.
Ready to go further? The next category explores Privacy Tools & Technologies to help you stay secure in a digital world.
Related articles in this series:
