GDPR

GDPR, the General Data Protection Regulation, is the European Union's comprehensive data protection and privacy law governing how organizations collect, process, store, and protect the personal data of people located in the EU.

GDPR has been in force since 2018 and applies broadly: any organization that processes the personal data of people in the EU is generally in scope, regardless of where the organization itself is based. The regulation gives individuals a defined set of rights over their own data, including the right to know what is held about them, to have inaccurate data corrected, to request deletion, often called the right to be forgotten, to receive a copy of their data in a portable format, and to object to certain kinds of processing, including automated decision making.

To support those rights, GDPR requires organizations to have a lawful basis for every use of personal data, to collect only what a stated purpose requires, and, critically, to be able to answer a basic question on demand: what personal data do we hold, where does it live, and everywhere it has moved since it was collected. That last requirement is where many organizations struggle, because personal data rarely stays in one system. It moves from an application database into a warehouse, through transformation pipelines, into analytics tools, and sometimes into models trained on it, and each hop needs to be accounted for. GDPR also requires organizations to report qualifying data breaches to a supervisory authority within a short, defined window, which depends on already knowing what data was affected and where it lived.

How GDPR Relates to Adjacent Terms

CCPA is the closest US analog: a state level consumer privacy law with its own set of rights, narrower in some respects and broader in others, but built on the same underlying need to locate and account for personal data. Personally identifiable information is the category of data GDPR regulates; GDPR defines the rules, PII is the thing the rules apply to. And data lineage and data provenance are the technical mechanisms that make GDPR's requirement to show where data lives and how it moved answerable in practice, rather than a manual, one time exercise.

What GDPR Compliance Requires in Practice

For a governance and compliance leader, GDPR readiness is tested at the moment a request, an audit, or a breach investigation actually happens, not when a policy document is written. Answering where a person's data lives and everywhere it has flowed across established systems, warehouses, and the application layer by hand is slow and prone to gaps, especially as codebases change faster than documentation does. Supporting a GDPR program at that level takes source code analysis: a current, provable map of where personal data originates and where it travels, generated from the code itself, that gives compliance and legal teams documentation that holds up under regulatory review instead of a best guess assembled under deadline.

Related Terms

• CCPA
• Personally identifiable information
• Data lineage
• Data provenance

Frequently Asked Questions

Does GDPR apply to our company if we're not based in the EU?

Generally, yes, if you process the personal data of people located in the EU, GDPR can apply to you regardless of where your company is headquartered. Scope depends on factors like whether you are offering goods or services to people in the EU or monitoring their behavior, not just where your servers or offices sit. Organizations outside the EU with EU customers or users should treat GDPR as applicable and confirm their specific obligations with legal counsel.

What counts as personal data under GDPR?

Personal data under GDPR is broad: any information relating to an identified or identifiable person, which includes obvious identifiers like name and email, but also things like device IDs, location data, and online identifiers when they can be linked back to a person. This is wider than many US definitions of personal information, which is part of why organizations need visibility into data that might not look sensitive at first glance.

How does GDPR relate to data lineage?

GDPR's core requirements, knowing what personal data you hold, honoring deletion and access requests, and reporting breaches accurately, all depend on knowing where data lives and how it has moved through your systems. Data lineage is the practice and technical record that answers that question. Without reliable lineage, GDPR compliance work becomes a manual, error prone exercise every time a request or an audit comes in.