What is the GDPR?
The GDPR sets out the conditions under which companies, public authorities and associations may collect, use, share and delete data about people, and which rights the people concerned have. It is Regulation (EU) 2016/679 and has applied since 25 May 2018. As a regulation it takes effect in every Member State without a transposing act.
Where the Regulation leaves room to the Member States, national laws fill it: in Germany the Federal Data Protection Act (BDSG), in Austria the Data Protection Act (DSG). Switzerland is not part of the EU and has its own Federal Act on Data Protection (FADP, SR 235.1), in force since 1 September 2023. The GDPR applies to a Swiss company only where the targeting principle in Article 3(2) is met.
Does the GDPR apply to your company?
Check applicability with four questions. The Regulation applies to the processing in question only if all four lead to it.
| Question | Provision | Applies if | Example |
|---|---|---|---|
| 1. Is it personal data? | Art. 4(1) | the information relates to an identified or identifiable natural person | name, staff number, IP address, device identifier |
| 2. Is it processed by automated means or in a filing system? | Art. 2(1) | wholly or partly by automated means, or in a structured filing system | CRM, email, structured personnel files |
| 3. Does no exemption apply? | Art. 2(2) | neither the household exemption (point (c)) nor law enforcement by competent authorities (point (d)) applies | The household exemption covers only natural persons in purely personal or household activities, not a company. |
| 4. Is there a territorial link to the EU? | Art. 3 | an establishment in the EU processes the data (paragraph 1), or goods or services are offered to people in the EU or their behaviour is monitored (paragraph 2) | A Swiss online shop delivers to customers in Germany. |
There is no size threshold for applicability. Thresholds such as the 250 employees in Article 30(5) or the 20 persons in § 38 BDSG concern individual duties, not the Regulation as a whole. A company without an establishment in the EU that falls under Article 3(2) designates a representative in the Union under Article 27, unless an exception under paragraph 2 applies.
The principles in Article 5
Article 5 is the yardstick for every processing operation. If you cannot justify a processing operation against these principles, you have a lawfulness problem that documentation cannot fix.
| Principle | What it requires |
|---|---|
| Lawfulness, fairness and transparency | a legal basis and understandable information for the data subject |
| Purpose limitation | purpose set before collection, no incompatible further processing |
| Data minimisation | only data necessary for the purpose |
| Accuracy | keep data up to date, correct or erase inaccurate data |
| Storage limitation | keep data in identifiable form only as long as the purpose requires |
| Integrity and confidentiality | appropriate protection against loss and unauthorised access |
| Accountability | the controller must be able to demonstrate compliance (Article 5(2)) |
Which legal basis does processing need, and which rights do data subjects have?
Every processing operation needs one of the six legal bases in Article 6(1): consent, contract, legal obligation, vital interests, public task or legitimate interests. For special categories such as health data or trade union membership, the prohibition in Article 9 and its exceptions apply in addition.
The data subject rights cover access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Under Article 12(3) the controller responds without undue delay and at the latest within one month. For complex or numerous requests it can extend by two months and informs the data subject of this within the first month.
Which duties follow from the GDPR?
For day-to-day operations, these are the main duties:
- a record of processing activities (Art. 30);
- technical and organisational measures appropriate to the risk to the data subjects (Art. 32);
- a data protection impact assessment where processing is likely to result in a high risk (Art. 35);
- a contract under Art. 28(3) with every service provider that processes data on your behalf;
- notification of a personal data breach to the competent supervisory authority without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk (Art. 33);
- communication to the data subjects where a high risk is likely (Art. 34);
- a data protection officer under Art. 37, and in Germany under § 38(1) BDSG also where, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data.
Which fine tier applies?
Article 83 provides two tiers; which one applies depends on the provision infringed. In each case the higher of the two amounts applies.
| Tier | Provision | Infringements covered | Example |
|---|---|---|---|
| up to €10 million or 2% of worldwide annual turnover | Art. 83(4)(a) | obligations of controllers and processors under Articles 8, 11, 25 to 39, 42 and 43 | missing record of processing activities, late breach notification |
| up to €20 million or 4% of worldwide annual turnover | Art. 83(5) | among others principles and legal bases (Art. 5, 6, 7, 9), data subject rights (Art. 12 to 22), transfers to third countries (Art. 44 to 49) | processing without a legal basis, unanswered access request |
If a company infringes several provisions in the same or linked processing operations, under Article 83(3) the total fine does not exceed the amount for the gravest infringement. In Germany the Länder supervisory authorities are competent for private bodies (§ 40(1) BDSG).
GDPR in Rizzqo
In Rizzqo, you mark which information and processes contain personal data, such as customer data or payroll, and which kinds. Every system and provider service linked to them shows this as well. So you see where personal data sits, for example for your record of processing under Article 30 or when assessing a breach under Article 33.