GDPR (General Data Protection Regulation)

The GDPR — the EU's General Data Protection Regulation, adopted 2016 and applicable since May 25, 2018 — is the comprehensive law governing personal data: any information relating to an identifiable person, processed by anyone targeting or monitoring people in the EU, wherever the company sits. It is the root system of modern privacy practice — the CCPA-family state laws, India's DPDPA, and the consent infrastructure this glossary documents all grew in its shadow — and the reason data protection became a board topic: fines reach 4% of global revenue or €20 million, whichever is higher.

The architecture marketers live inside: every processing purpose needs a lawful basis (six exist; marketing mostly runs on consent and legitimate interest — consent to the GDPR's standard is freely given, specific, informed, and unambiguous, the bar that killed pre-ticked boxes, while legitimate interest demands the documented balancing test and survives objection rights), the data-subject rights are operational obligations (the DSAR entry's access machinery, erasure, portability, objection — each with the one-month clock), and accountability is structural: records of processing, data-protection impact assessments for risky processing, processor contracts (the DPA every vendor signature chain carries), breach notification at 72 hours, and data-protection officers where scale demands. The marketing-specific seams: consent for tracking arrives via the EPRIVACY-DIRECTIVE with GDPR defining the consent's quality (the two-law split that entry explains), profiling and automated decisions carry extra rights, international transfers run the EU-US-DATA-PRIVACY-FRAMEWORK and SCC machinery, and enforcement has repeatedly aimed at marketing's plumbing — consent banners, adtech's TCF framework, and behavioral advertising's lawful-basis claims producing the headline fines. The compliance posture that works is this glossary's recurring one: privacy as engineered data flow — consent wired to firing rules, rights wired to systems, vendors mapped — not policy PDFs.

The GDPR matters to anyone with EU users — extraterritorially, by design — and as the template even where it doesn't bind: building to its standard is how global stacks stay coherent (the strictest-common-denominator strategy the state-law entries recommend). It matters most at the lawful-basis choices (consent versus legitimate interest decides UX, data volume, and risk), the rights plumbing, and vendor chains. The discipline: one basis per purpose, documented; consent to the real standard; rights that work end to end; and the standing audit of what actually fires, because enforcement reads tag managers, not mission statements. (General information, not legal advice.)

The GDPR was adopted in April 2016 and became applicable May 25, 2018 — replacing the 1995 Directive with directly binding regulation, extraterritorial scope, and the fine schedule that made privacy a board topic; it remains the template the world's privacy laws keep copying.

Etymology: source.

Search interest for this term over the last five years:

View interest-over-time on Google Trends →

Areas of marketing where gdpr is a core concern: