GDPR (General Data Protection Regulation)

The General Data Protection Regulation (GDPR) is a comprehensive data protection law enacted by the European Union (EU) in May 2018. It sets strict guidelines for how organisations collect, process, store, and share personal data of EU citizens, regardless of where the organisation is based.

Under GDPR, businesses must ensure that personal data is handled transparently and securely. Key principles include obtaining clear consent from individuals, minimising data collection to what is strictly necessary, and allowing individuals to access, correct, or delete their data. Organisations must also notify authorities and affected individuals promptly in the event of a data breach.

Failure to comply with GDPR can result in significant fines, up to €20 million or 4% of the organisation’s annual global turnover, whichever is higher. Additionally, non-compliance can damage a company’s reputation and erode customer trust.

In Gibraltar, as a British Overseas Territory, GDPR standards continue to apply post-Brexit through equivalent legislation. For businesses operating in Gibraltar, adhering to GDPR ensures compliance with international data protection norms and enhances trust among clients and stakeholders.