Data privacy concerns the rights of individuals to control
how their personal information is
collected, used and shared. The European Union s General
Data Protection Regulation (GDPR), in
force since 2018, sets strict requirements for organisations
processing personal data of EU
Data Privacyresidents.
and the
lawfulness,
TheGDPR
GDPR outlines seven core principles:
fairness and transparency;
purpose limitation (data collected for specified, explicit
purposes); data minimisation;
accuracy; storage limitation (keeping data no longer than
necessary); integrity and
confidentiality (security); and accountability. Organisations
must have a lawful basis for
processing personal data (such as consent, contract
performance or legitimate interests) and
inform individuals about data uses. Data subjects enjoy
rights to be informed, access their
data, rectify inaccuracies, erase data ( right to be
forgotten ), restrict processing, port
their data to another provider, object to certain processing
and not be subject to solely
automated decisions. Controllers must implement
appropriate technical and organisational
measures to protect data, conduct impact assessments for
high risk processing and notify
authorities and affected individuals of breaches.
Non compliance can result in hefty fines and
reputational damage. Beyond the EU, privacy frameworks
such as California s CCPA, Canada s
PIPEDA and Brazil s LGPD reflect a global trend towards
stronger protections. Businesses should
build privacy by design into systems, minimise data
collection, provide clear notices and
ensure third party partners adhere to privacy standards.