What Is GDPR? – Definition and What It Requires
Learn what the GDPR governs, its core principles, what lawful basis means, and how it applies to publicly available personal data.
The General Data Protection Regulation governs the processing of personal data relating to people in the European Union and European Economic Area. It applies by the location of the individuals, not the organisation — which is why it reaches well beyond Europe. Nothing here is legal advice.
1. What Counts as Personal Data
Any information relating to an identifiable person: names, email addresses, phone numbers, addresses, online identifiers, and any combination that allows identification.
The bar is lower than people expect. Data that identifies nobody alone can be personal data when combined with something else, which is the case that catches collected datasets.
2. The Core Principles
| Principle | Requirement |
|---|---|
| Lawfulness, fairness, transparency | A valid basis, and people told what happens |
| Purpose limitation | Used only for the stated purpose |
| Data minimisation | Only what the purpose requires |
| Accuracy | Kept correct and up to date |
| Storage limitation | Kept no longer than needed |
| Integrity and confidentiality | Secured appropriately |
| Accountability | Able to demonstrate compliance |
3. Processing Requires a Lawful Basis
Six bases exist, and consent is only one. For collected data the relevant one is usually legitimate interests, which requires a documented balancing assessment weighing your interest against the individual's rights.
That assessment is a deliverable, not a formality: the absence of one is itself a compliance failure.
4. Public Availability Is Not Consent
This is the single most consequential point for anyone collecting web data. Personal data being publicly visible does not remove the obligations.
Collecting a published email address still constitutes processing personal data. A lawful basis, a purpose, retention limits, security, and the ability to honour rights requests all still apply.
5. Individual Rights
People can request access to their data, correction, deletion, restriction, portability, and objection to processing.
Honouring them requires knowing what you hold and where — which means provenance and searchability are compliance requirements rather than engineering niceties.
6. Transparency Applies Even Without Contact
Where data is collected without the individual's involvement, they must generally be informed within a reasonable period, including the source. There are exceptions, and they are narrower than convenient.
For collected datasets this obligation is frequently overlooked entirely.
7. Practical Steps for Collected Data
- Determine whether any personal data is present — usually more than expected.
- Define and document the purpose.
- Identify and document the lawful basis, with a balancing assessment.
- Minimise: collect and keep only what the purpose requires.
- Set and enforce retention, including deletion that works.
- Keep provenance so rights requests can be answered.
- Secure it, and restrict access.
- Take advice where the position is unclear.
8. Summary
The GDPR governs processing of personal data about people in the EU and EEA, applying wherever the processor is based, and requires a lawful basis, a defined purpose, minimisation, limited retention, security, and respect for individual rights.
Public availability changes none of it. For collected data the practical obligations are documentation, minimisation, enforced retention, and the ability to find and delete what you hold.