GDPR and Data Subject Rights

The General Data Protection Regulation (GDPR) is a European Union privacy law that took effect on May 25, 2018. It governs how organizations collect, store, process, and share personal data belonging to EU residents — regardless of where the organization itself is located. A US company that collects data from EU website visitors must comply with GDPR. Violations carry penalties up to €20 million or 4% of global annual turnover, whichever is higher, making GDPR one of the most consequential privacy regulations globally.

GDPR introduces specific terminology. Personal data is any information relating to an identified or identifiable natural person (data subject). A data controller determines the purposes and means of processing — typically the organization collecting data. A data processor processes data on behalf of the controller (cloud providers, analytics vendors). Processing includes any operation on personal data: collection, storage, modification, transfer, or deletion. Understanding these roles is crucial because GDPR assigns different obligations to controllers versus processors.

Organizations must identify a lawful basis before processing personal data. GDPR defines six bases: Consent (freely given, specific, informed, unambiguous); Contract (necessary to fulfill a contract with the data subject); Legal obligation (required by law); Vital interests (protecting someone's life); Public task (public interest or official authority); and Legitimate interests (balanced against the data subject's rights). Consent must meet a high bar — pre-ticked boxes do not qualify.

Article 5 of GDPR establishes seven principles. Lawfulness, fairness, and transparency — data must be processed legally and openly. Purpose limitation — data collected for one purpose cannot be repurposed without a new lawful basis. Data minimization — only collect what is strictly necessary. Accuracy — keep data up to date. Storage limitation — do not retain data longer than needed. Integrity and confidentiality — apply appropriate security controls. Accountability — organizations must be able to demonstrate compliance.

GDPR grants individuals (data subjects) several enforceable rights. The right of access (Article 15) allows individuals to request a copy of all personal data an organization holds about them, along with details of processing purposes, retention periods, and third-party recipients. Organizations must respond within one month (extendable to three months for complex requests). This right is fulfilled through a Subject Access Request (SAR) process that most GDPR-compliant organizations document in their privacy policy.

The right to erasure ('right to be forgotten', Article 17) allows individuals to request deletion of their data when it is no longer necessary, consent is withdrawn, or the data was unlawfully processed. The right to rectification (Article 16) lets individuals correct inaccurate or incomplete data. Neither right is absolute — data needed to fulfill a legal obligation or defend legal claims does not need to be erased. These rights create significant data architecture challenges, particularly in systems with replicated or archived databases.

The right to data portability (Article 20) allows individuals to receive their personal data in a structured, machine-readable format (JSON, CSV) and transmit it to another controller — facilitating switching between service providers. The right to object (Article 21) lets individuals stop certain processing, particularly for direct marketing (which must be stopped immediately upon objection) or for legitimate interests processing (where the organization must demonstrate compelling grounds to continue).

GDPR Article 33 requires organizations to notify their supervisory authority (national data protection authority, such as the UK ICO or Germany's BSI) within 72 hours of becoming aware of a personal data breach that risks individuals' rights. If the breach is likely to result in high risk to individuals, the affected data subjects must also be notified directly without undue delay (Article 34). This 72-hour deadline is significantly shorter than breach notification windows in many US state laws.

GDPR requires certain organizations to appoint a Data Protection Officer (DPO): public authorities, organizations that process large-scale sensitive data (health, biometric, criminal), or those that engage in large-scale systematic monitoring (behavioral advertising). The DPO must have expert knowledge of data protection law, must be independent (cannot be disciplined for performing DPO duties), and acts as the primary point of contact with the supervisory authority. Organizations not required to appoint a DPO often do so voluntarily for accountability.

GDPR restricts transferring personal data to countries outside the EU/EEA unless adequate protections exist. Adequacy decisions recognize countries with equivalent protection levels (Japan, Canada, UK post-Brexit, USA under the EU-US Data Privacy Framework). In the absence of an adequacy decision, organizations use Standard Contractual Clauses (SCCs) — pre-approved model contracts — or Binding Corporate Rules (BCRs) for intra-group transfers within multinationals. Unauthorized international data transfers are a common source of GDPR enforcement actions.

GDPR has two tiers of administrative fines. Tier 1 (lower): up to €10 million or 2% of global annual turnover for violations such as failure to maintain records, breach notification failures, or insufficient data processor agreements. Tier 2 (higher): up to €20 million or 4% of global annual turnover for fundamental violations — unlawful processing, no lawful basis, violation of data subject rights. Notable enforcement actions include fines against Google (€50M), Meta (€1.2B), and Amazon (€746M).

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: GDPR governs personal data of EU residents and applies globally, with fines up to 4% of global revenue, six data subject rights include access, erasure, rectification, portability, objection, and restriction, and 72-hour breach notification to supervisory authorities is mandatory for breaches risking individual rights. Next up we explore HIPAA, PCI-DSS, and sector-specific compliance requirements.