The General Data Protection Regulation (EU) 2016/679 (GDPR) is a regulation in EU law on data protection and privacy in the European Union (EU) and the European Economic Area (EEA). It also addresses the transfer of personal data outside the EU and EEA areas. The GDPR's primary aim is to give individuals control over their personal data and to simplify the regulatory environment for international business by unifying the regulation within the EU. Superseding the Data Protection Directive 95/46/EC, the regulation contains provisions and requirements related to the processing of personal data of individuals (formally called data subjects in the GDPR) who are located in the EEA, and applies to any enterprise—regardless of its location and the data subjects' citizenship or residence—that is processing the personal information of individuals inside the EEA.a
Controllers and processors of personal data must put in place appropriate technical and organizational measures to implement the data protection principles. Business processes that handle personal data must be designed and built with consideration of the principles and provide safeguards to protect data (for example, using pseudonymization or full anonymization where appropriate). Data controllers must design information systems with privacy in mind. For instance, using the highest-possible privacy settings by default, so that the datasets are not publicly available by default and cannot be used to identify a subject. No personal data may be processed unless this processing is done under one of the six lawful bases specified by the regulation (consent, contract, public task, vital interest, legitimate interest or legal requirement). When the processing is based on consent the data subject has the right to revoke it at any time.
Data controllers must clearly disclose any data collection, declare the lawful basis and purpose for data processing, and state how long data is being retained and if it is being shared with any third parties or outside of the EEA. Firms have the obligation to protect data of employees and consumers to the degree where only the necessary data is extracted with minimum interference with data privacy from employees, consumers, or third parties. Firms should have internal controls and regulations for various departments such as audit, internal controls, and operations. Data subjects have the right to request a portable copy of the data collected by a controller in a common format, and the right to have their data erased under certain circumstances. Public authorities, and businesses whose core activities consist of regular or systematic processing of personal data, are required to employ a data protection officer (DPO), who is responsible for managing compliance with the GDPR. Businesses must report data breaches to national supervisory authorities within 72 hours if they have an adverse effect on user privacy. In some cases, violators of the GDPR may be fined up to €20 million or up to 4% of the annual worldwide turnover of the preceding financial year in case of an enterprise, whichever is greater.
The GDPR was adopted on 14 April 2016, and became enforceable beginning 25 May 2018. As the GDPR is a regulation, not a directive, it is directly binding and applicable, but does provide flexibility for certain aspects of the regulation to be adjusted by individual member states.
The regulation became a model for many national laws outside EU, including Chile, Japan, Brazil, South Korea, Argentina and Kenya. The California Consumer Privacy Act (CCPA), adopted on 28 June 2018, has many similarities with the GDPR.
Sheria ya Ulinzi wa Takwimu ya Umma (GDPR) ni sheria ya EU ya ulinzi wa data na faragha katika Umoja wa Ulaya (EU) na EEA. Pia inashughulikia uhamisho wa data ya kibinafsi nje ya maeneo ya EU na EEA. Lengo kuu la GDPR ni kuwapa watu binafsi udhibiti juu ya data zao za kibinafsi na kurahisisha mazingira ya udhibiti kwa biashara ya kimataifa kwa kuunganisha kanuni ndani ya EU. "Kupitia Sheria ya Ulinzi wa Takwimu ya EU (954 EC), kanuni hii inatoa sheria na masharti yanayohusiana na usindikaji wa data ya kibinafsi ya watu binafsi (waliotajwa rasmi katika GDPR) ambao wako katika EEA, na inatumika kwa biashara yoyote - bila kujali eneo lake na uraia au makazi ya watu binafsi - ambayo inashughulikia habari ya kibinafsi ya watu binafsi ndani ya EEA. """ Mchakato wa biashara ambao hushughulikia data ya kibinafsi lazima uandaliwe na kujengwa kwa kuzingatia kanuni na kutoa ulinzi ili kulinda data (kwa mfano, kutumia pseudonymization au anonymization kamili mahali inapofaa). Wasimamizi wa data lazima kubuni mifumo ya habari na faragha katika akili. Kwa mfano, kutumia mipangilio ya faragha ya juu zaidi inayowezekana kwa default, ili seti za data hazipatikani kwa umma kwa default na haziwezi kutumiwa kutambua somo. Hakuna data ya kibinafsi inaweza kusindika isipokuwa usindikaji huu unafanywa chini ya moja ya misingi sita ya kisheria iliyoainishwa na kanuni (kubali, mkataba, kazi ya umma, maslahi muhimu, maslahi halali au mahitaji ya kisheria). Wakati usindikaji unategemea idhini, mtu anayehusika ana haki ya kuiondoa wakati wowote. Wasimamizi wa data lazima wafunue wazi kila mkusanyiko wa data, watangaza msingi wa kisheria na kusudi la usindikaji wa data, na wasema ni kwa muda gani data inahifadhiwa na ikiwa inashirikiwa na watu wa tatu au nje ya EEA. Kampuni zina wajibu wa kulinda data ya wafanyakazi na watumiaji kwa kiwango ambacho data muhimu tu hutolewa na kuingilia chini ya faragha ya data kutoka kwa wafanyikazi, watumiaji au watu wa tatu. Kampuni zinapaswa kuwa na udhibiti wa ndani na kanuni kwa idara mbalimbali kama vile ukaguzi, udhibiti wa ndani, na shughuli. Watu waliohusika na data wana haki ya kuomba nakala inayoweza kubebwa ya data zilizokusanywa na msimamizi katika muundo wa kawaida, na haki ya kufuta data zao chini ya hali fulani. Mamlaka za umma na biashara ambazo shughuli zao kuu ni usindikaji wa kawaida au wa utaratibu wa data ya kibinafsi zinahitajika kuajiri afisa wa ulinzi wa data (DPO) ambaye anawajibika kwa usimamizi wa kufuata GDPR. Kampuni lazima zirejelee uvunjaji wa data kwa mamlaka za usimamizi wa kitaifa ndani ya masaa 72 ikiwa zina athari mbaya kwa faragha ya mtumiaji. Kwa mfano, wavunjaji wa GDPR wanaweza kutozwa faini ya € 20 milioni au hadi 4% ya mauzo ya kila mwaka ya mwaka wa kifedha, ikiwa ni biashara, kulingana na kiwango kikubwa. GDPR ilitolewa mnamo 14 Aprili 2016 na kuanza kutekelezwa mnamo 25 Mei 2018. GDPR ni kanuni, sio maelekezo, na ni ya moja kwa moja ya kulazimisha na kutumika, lakini hutoa kubadilika kwa mambo fulani ya kanuni ambayo yanaweza kurekebishwa na nchi wanachama. Sheria hiyo ilichukuliwa kama mfano wa sheria za nchi nyingi nje ya EU, ikiwa ni pamoja na Chile, Japan, Brazil, Korea Kusini, Argentina na Kenya. Sheria ya Faragha ya Watumiaji ya California (CCPA) iliyopitishwa mnamo Juni 28, 2018 ina mambo mengi yanayofanana na GDPR.