GDPR
General Data Protection Regulation: EU law governing how personal data is collected, stored, and processed. Requires consent, data portability, and the right to be forgotten.
What is GDPR?
In short
GDPR (General Data Protection Regulation) is a European Union law, in force since May 25, 2018, that governs how organizations collect, store, and process the personal data of people in the EU and EEA. It applies to any company anywhere in the world that handles that data, requires a lawful basis such as consent to process it, gives people rights like access, portability, and erasure, and allows fines up to 20 million euros or 4 percent of global annual revenue, whichever is higher.
What GDPR Actually Is
GDPR is Regulation 2016/679, a single law that replaced a patchwork of national rules across the 27 EU member states plus the EEA countries (Iceland, Liechtenstein, Norway). Because it is a regulation and not a directive, it applies directly in every member state without each country writing its own version.
It covers personal data, which is any information that can identify a living person: a name, email, IP address, device ID, location, or even a cookie identifier. A subset called special category data (health, biometrics, race, religion, political views, sexual orientation) gets stricter protection.
The reach is extraterritorial. If you are a startup in India or the US and you offer goods or services to people in the EU, or you track their behavior, GDPR applies to you. This is why a small SaaS company in Bangalore still ends up writing a privacy policy that talks about EU data subject rights.
How It Works Under the Hood
Every act of processing personal data needs a lawful basis. There are six: consent, contract, legal obligation, key interests, public task, and legitimate interests. Consent is the one most people know, but it is often the weakest choice because it has to be freely given, specific, informed, and as easy to withdraw as to give. A pre-ticked checkbox is not valid consent.
GDPR splits responsibility between the controller (the company that decides why and how data is processed) and the processor (a vendor that processes data on the controller's behalf, like AWS or a payment provider). The two sign a Data Processing Agreement that spells out obligations. A controller stays liable even when a processor causes the breach.
It grants individuals concrete rights: access (get a copy of their data), rectification (fix errors), erasure (the right to be forgotten), portability (export data in a machine-readable format like JSON or CSV), and the right to object. Most requests must be answered within one month, free of charge.
Two engineering principles are baked in. Data protection by design means privacy is a default in the system, not bolted on later. Data minimization means you only collect what you actually need. If a data breach happens, the controller must notify the supervisory authority within 72 hours of becoming aware of it.
When It Matters and the Trade-offs
GDPR matters the moment you store anything that points back to a real EU person. For most web and mobile products that is the default situation, so the practical question is not whether it applies but how much engineering it forces.
The cost is real. You need consent management for cookies, audit logs of what data you hold and why, deletion pipelines that can fully erase a user across your primary database, backups, analytics, and third-party tools, and a way to export a user's data on demand. Cross-border transfers out of the EU need a legal mechanism such as Standard Contractual Clauses, which got more complex after the Schrems II ruling invalidated the Privacy Shield in 2020.
The trade-off is between data utility and legal risk. Hoarding data for some future machine learning use is exactly what GDPR discourages, and storing special category data raises your exposure sharply. Teams that treat compliance as a design constraint early (clear schemas, soft-delete plus hard-delete jobs, regional data residency) pay far less than teams that retrofit it after a regulator asks questions.
Enforcement is not theoretical. Fines come in two tiers, up to 10 million euros or 2 percent of global turnover for lesser violations, and up to 20 million euros or 4 percent for serious ones. Regulators have issued billions in penalties since 2018.
A Concrete Example
In 2023 the Irish Data Protection Commission fined Meta 1.2 billion euros, the largest GDPR fine to date, for transferring European Facebook user data to US servers without adequate protection against US surveillance laws. That single ruling forced Meta to rethink where EU data physically lives.
On a smaller scale, picture a typical product flow. A user in Germany signs up. Your cookie banner records their consent choice with a timestamp and stores it. Their profile, activity logs, and analytics events all carry a user ID. Months later they email a deletion request. Your system has 30 days to run a job that removes their row from Postgres, purges their events from your analytics warehouse, tells your email provider and payment processor to delete their records, and confirms back to the user.
If you cannot do that cleanly because the user ID is smeared across logs, caches, and a data lake with no deletion path, you have a GDPR problem long before any regulator calls. This is why GDPR is as much a data architecture topic as a legal one.
Where it is used in production
Meta (Facebook)
Fined 1.2 billion euros in 2023 for transferring EU user data to US servers without adequate safeguards, the largest GDPR penalty so far.
Amazon Web Services
Offers EU regions like Frankfurt and Dublin plus Data Processing Addendums so customers can keep EU data resident and meet controller-processor obligations.
Was fined 50 million euros by France's CNIL in 2019 for unclear consent and insufficient transparency in its ad personalization.
Cloudflare
Provides EU data localization and regional services so traffic and logs for EU users can be processed inside the EU.
Frequently asked questions
- Does GDPR apply to companies outside the EU?
- Yes. If you offer goods or services to people in the EU or EEA, or you monitor their behavior, GDPR applies no matter where your company is based. A US or Indian startup with EU users must comply.
- What is the difference between a data controller and a data processor?
- The controller decides why and how personal data is processed and is the one ultimately responsible. The processor handles the data on the controller's instructions, like a cloud host or analytics vendor. They sign a Data Processing Agreement, and the controller stays liable even for the processor's mistakes.
- What is the right to be forgotten?
- It is the right to erasure under Article 17. A person can ask you to delete their personal data, and unless you have a legal reason to keep it you must remove it across your systems, usually within one month. In practice that means a deletion pipeline that reaches your database, backups, analytics, and third-party tools.
- How big can GDPR fines get?
- Up to 10 million euros or 2 percent of global annual revenue for lesser violations, and up to 20 million euros or 4 percent for serious ones, whichever figure is higher. Meta's 1.2 billion euro fine in 2023 is the record so far.
- Do I always need consent to process personal data?
- No. Consent is only one of six lawful bases. You can also rely on performing a contract, a legal obligation, key interests, a public task, or legitimate interests. Consent is often the hardest to rely on because it must be freely given and easy to withdraw.
Learn GDPR hands-on
This page explains the idea. The full lesson lets you step through the ring as servers join and leave, read the implementation, and check yourself with a quiz. It is one of 760+ lessons in the System Design Masterclass, from your first API call to distributed consensus. Eleven Foundation lessons are free, no signup. Lifetime access is ₹499 in India or $7.99 worldwide, one payment, no subscription.
Related lessons
Lessons that touch on GDPR as part of a larger topic.
GDPR Compliance
The engineer's guide to GDPR: understand the regulation that changed how every tech company handles personal data
intermediate · data governance compliance
Data Retention Policies
Define how long data is kept, when it's archived, and when it's deleted, balancing compliance, cost, and utility
intermediate · data governance compliance
Data Privacy
Protect personal information by design, privacy isn't a feature you add later, it's an architecture decision
intermediate · data governance compliance
Data Anonymization
Remove all identifying information so individuals can never be re-identified, the strongest form of privacy protection
intermediate · data governance compliance
Data Pseudonymization
Replace identifiers with tokens, reversible with the right key, offering a middle ground between raw data and full anonymization
intermediate · data governance compliance
See also
Related glossary terms you might want to look up next.
PII
Personally Identifiable Information: any data that can identify a specific individual, like name, email, SSN, or IP address. Must be encrypted and access-controlled.
Data Encryption
Transforming data into an unreadable format using cryptographic algorithms. Encryption at rest protects stored data; encryption in transit protects data over the network.
Data Lineage
Tracking data from its origin through every transformation and system it passes through. Answers 'where did this number come from?' for audits and debugging.
Data Catalog
A searchable inventory of all datasets in an organization, with metadata like schema, owner, freshness, and lineage. The 'Google for your data.'
Data Masking
Replacing sensitive data with realistic but fake values so developers and testers can work with production-like data without exposing real PII.