Skip to content
Shout Help Center

What is GDPR

What is GDPR?

Section titled “What is GDPR?”

The General Data Protection Regulation (GDPR) is the EU regulation governing the processing of personal data. It has applied since 25 May 2018. In the UK, the UK GDPR operates alongside the Data Protection Act 2018; the Data Protection Act 1998 has been replaced.

Who does GDPR apply to?

Section titled “Who does GDPR apply to?”

The EU GDPR applies to processing in the context of an establishment in the EU. It can also apply to an organisation outside the EU when it offers goods or services to people in the EU, or monitors their behaviour there. Its scope is not determined simply by a person’s citizenship. See the European Commission’s explanation of GDPR scope.

Key terms are:

  • Data Controller: determines why and how personal data is processed.
  • Data Processor: processes personal data on the controller’s behalf.
  • Processing: includes collecting, recording, storing, using, sharing and deleting personal data.
  • Data Subject: the individual the personal data relates to.

Controllers and processors have responsibilities according to their roles. Controllers must use appropriate processor contracts, and processors must follow the controller’s documented instructions, subject to applicable legal requirements. See the ICO’s guidance on processors.

What information does GDPR apply to?

Section titled “What information does GDPR apply to?”

Personal data is information relating to an identified or identifiable individual. Identifiers can include names, identification numbers, location data and online identifiers such as IP addresses. Pseudonymising data does not automatically take it outside GDPR: it remains personal data when individuals can still be identified using additional information. See What is personal data?.

Special category data includes racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, health information, and information about sex life or sexual orientation. Criminal-offence data is subject to separate safeguards. See the ICO’s explanation of special category data.

Data retention

Section titled “Data retention”

Privacy information should explain how long personal data will be retained, or the criteria used to determine that period. GDPR does not prescribe one retention period for every type of data. See the ICO’s guidance on privacy information.

What does Brexit mean for GDPR?

Section titled “What does Brexit mean for GDPR?”

UK data protection is governed by the UK GDPR and the Data Protection Act 2018. The Data (Use and Access) Act 2025 amends that framework; it does not replace it. See the government’s explanation of the changes and commencement information.

UK organisations may also need to comply with the EU GDPR where their activities fall within its territorial scope, as described above.

Penalties

Section titled “Penalties”

For the most serious EU GDPR infringements, the maximum administrative fine is €20 million, or, for an undertaking, 4% of its total worldwide annual turnover in the preceding financial year, whichever is higher. The equivalent higher maximum under UK GDPR is £17.5 million, or 4% for an undertaking, whichever is higher. Other infringements have lower statutory maxima; the actual penalty depends on the circumstances. See EU GDPR Article 83 and the ICO’s explanation of UK fine limits.

Personal data breaches

Section titled “Personal data breaches”

A controller must notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless it is unlikely to pose a risk to individuals’ rights and freedoms. A processor must notify the controller without undue delay.

Where a breach is likely to pose a high risk to individuals, the controller must also inform affected individuals without undue delay, subject to the applicable exceptions. See the ICO’s personal data breach guidance.

Data Protection Officers

Section titled “Data Protection Officers”

A controller or processor must appoint a Data Protection Officer (DPO) where it:

  1. is a public authority or body, except a court acting in its judicial capacity;
  2. has core activities requiring regular and systematic monitoring of individuals on a large scale; or
  3. has core activities involving large-scale processing of special category data or criminal-offence data.

See the ICO’s guidance on Data Protection Officers.