ICISO
Back to Frameworks

GDPR

General Data Protection Regulation

What is GDPR?

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that came into effect on May 25, 2018. It governs how organizations collect, store, process, and protect the personal data of individuals in the European Union.

GDPR applies to any organization worldwide that processes personal data of EU residents, making it one of the most far-reaching data protection regulations globally. It emphasizes transparency, user consent, and individual rights over personal data.

When Does GDPR Apply?

EU-Based Organizations

Any organization established in the EU that processes personal data, regardless of where the processing takes place.

Organizations Targeting EU Residents

Non-EU organizations offering goods or services to, or monitoring the behavior of, EU residents.

E-commerce & Digital Services

Online businesses, SaaS providers, and digital platforms serving European customers.

Seven Key Principles

Lawfulness, Fairness, and Transparency
Purpose Limitation
Data Minimization
Accuracy
Storage Limitation
Integrity and Confidentiality
Accountability

Data Subject Rights

Right to be Informed
Right of Access
Right to Rectification
Right to Erasure (Right to be Forgotten)
Right to Restrict Processing
Right to Data Portability
Right to Object
Rights related to Automated Decision Making

Non-Compliance Penalties

GDPR violations can result in significant fines:

Lower Tier

Up to €10 million or 2% of annual global turnover (whichever is higher)

Upper Tier

Up to €20 million or 4% of annual global turnover (whichever is higher)

Simplify Your GDPR Compliance

ICISO's AI-powered platform helps you map data flows, manage consent, automate data subject requests, and maintain continuous GDPR compliance. Protect customer data while building trust.

Get Started with ICISO