GDPR compliance and data protection

The regulation says who it reaches in as many words. It applies to a controller or processor not established in the union where the processing relates to offering goods or services to people in the union, paid or free, or to monitoring their behaviour there.

So the address of your company decides nothing. Analytics on a European visitor is monitoring; a free tier open to European users is an offering.

The next question is your role. A controller decides why and how data is processed; a processor only acts on instructions. Most products are a controller for their own users and a processor for their business customers at once.

The four duties that decide everything else

A lawful ground for every purpose

There are six, and consent is only one: a contract, a legal obligation, vital interests, a public task and legitimate interests are the others. Each purpose gets its own.

A representative inside the union

A company caught from outside designates one in writing, in a member state where its users are. Only occasional, low-risk processing is let off, and public authorities.

A record of processing activities

Purposes, categories of people and data, recipients, transfers, retention. Fewer than 250 employees is no release if the processing is regular or touches special categories.

An officer, where the trigger is met

An officer is compulsory for a public body, for large-scale regular monitoring of people and for large-scale processing of special or criminal data.

The deadlines and the money

A breach goes to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware; a later notice carries the reasons. A request is answered within one month, extendable by two more for genuinely complex cases if you say so inside the first.

Fines run in two bands. Breaching the duties of a controller or processor reaches 10 million euro or 2% of worldwide annual turnover, whichever is higher. Breaching the basic principles, the conditions for consent, the rights of people or the rules on transfers reaches 20 million euro or 4%.

Sending data out of Europe

A transfer needs either a decision that the destination country protects data adequately, or safeguards of your own: standard contractual clauses adopted by the commission, or binding corporate rules inside a group. The safeguard belongs in the contract with the recipient before the data moves rather than after a customer asks.

A privacy policy, and what a generator leaves out

The policy is the visible part of all this. A privacy policy generator writes a document from a questionnaire; it cannot check the answers against your build, pick your lawful grounds or answer a request inside the deadline.

Where the rules are not European

The Californian code

There a verified request is answered inside 45 days, with one extension, and fines reach 2,500 dollars per violation, or 7,500 if it was intentional or touched someone under 16.

Children in the United States

The federal rule on under-13s asks for a parent's verified agreement before anything is gathered, and adds a written security programme and a ceiling on how long the data is kept.

Sources: the reach of the regulation, the representative, the record, the officer, 72 hours, one month, the transfer safeguards and both fine bands — the General Data Protection Regulation; the Californian deadline and amounts — Civil Code 1798.155; the American children's duties — 16 CFR part 312.