GDPR (General Data Protection Regulation) is Regulation (EU) 2016/679, the EU's framework for the processing of personal data of people in the EU and EEA. It has been directly applicable in every member state since May 25, 2018. The regulation governs lawful basis, controller and processor duties, individual rights, transfers outside the EU, and supervisory enforcement.
What is the difference between a controller and a processor?
GDPR splits actors into controllers (decide why and how) and processors (act on the controller's instructions). Article 28 governs that contract.
A SaaS vendor processing customer data is almost always a processor; the customer is the controller. Article 28 of Regulation (EU) 2016/679 requires a written agreement (the DPA) and lists the eight clauses that contract must contain.
What does GDPR require for security?
Article 32 sets the security baseline for processing personal data, calling for risk-appropriate technical and organizational measures.
Article 32 names pseudonymization, encryption, confidentiality, integrity, availability, resilience, and a process for regularly testing controls as the kinds of measures the regulation contemplates. Sector regulations like DORA layer on top of Article 32 for EU financial entities.
How big are GDPR fines?
Fines reach up to 20 million euros or 4 percent of annual global turnover, whichever is higher, under Article 83 for the most serious violations.
The two-tier ceiling (10 million / 2% for procedural breaches, 20 million / 4% for rights and consent violations) is in Article 83. We see most TPRM teams over-invest in DPA red-lining and under-invest in tracking sub-processors and Article 32 control evidence after signing.
Related terms
These adjacent terms describe the contract artifacts and resilience regulations that pair with GDPR in any EU-facing vendor or sub-processor review.
- DPA - the Data Processing Agreement required by Article 28 between a controller and processor
- Sub-processor - a vendor's vendor that touches personal data, governed by Article 28(2) and (4)
- TPRM - the vendor-risk discipline through which most controllers track sub-processor changes
- DORA - the EU financial-sector regulation that sits on top of GDPR Article 32 for ICT risk