Personal data is part of everyday business. The GDPR sets rules for how organisations collect, use, store and share information about identifiable people. Understanding the principles helps teams make better decisions about products, processes and suppliers.
What the GDPR is designed to do
The General Data Protection Regulation (Regulation (EU) 2016/679) establishes a framework for protecting personal data in the EU. It sets principles for processing, defines rights for individuals and places responsibilities on organisations that determine or carry out processing.
Questions businesses should be able to answer
A simple way to review a processing activity. The GDPR principles and lawful basis need to be considered throughout the lifecycle, not just at collection.
- What personal data do we collect and why?
- What is our lawful basis for each processing activity?
- How do we explain our use of personal data to people?
- How long do we keep information, and how is it protected?
- Which suppliers and systems process data on our behalf?
- How do people exercise their rights, and how do we handle incidents?
Where technology teams fit in
Product design, analytics, AI tools, customer support platforms and cloud services can all involve personal data. Data protection is most effective when it is considered during procurement, architecture, development and operational change — not only when a document needs updating.
This page is an introductory overview. Detailed guidance should be tailored to the organisation, processing activities and relevant national law.
