The General Data Protection Regulation, Regulation (EU) 2016/679, affects practically every company, because personal data arises everywhere: in the customer database, in HR administration, in emails and in log files. As an EU regulation, it applies directly. National laws such as the DSG (Austrian Data Protection Act) or the BDSG (German Federal Data Protection Act) supplement it on individual points. Companies outside the EU can also be covered, for example if they offer goods or services to people in the EU.
Supervision lies with national authorities; in Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde). For serious violations, fines of up to €20 million or 4% of worldwide annual turnover are possible, whichever amount is higher.
How the GDPR is structured
At its core are the principles from Art. 5:
- Lawfulness and transparency: Every processing operation needs a legal basis, such as a contract, a legal obligation, a legitimate interest or consent. Data subjects must be informed.
- Purpose limitation, data minimization and accuracy: only as much data as necessary for the specified purpose, and that data must be accurate.
- Storage limitation: Data is deleted when the purpose no longer applies and no retention obligation stands in the way.
- Integrity and confidentiality: protection through technical and organizational measures.
- Accountability: The company must be able to demonstrate compliance.
Data subjects have rights including access, rectification, erasure and objection. Company obligations include a record of processing activities, data processing agreements (DPAs) with service providers and reporting personal data breaches to the supervisory authority, generally within 72 hours.
Typical examples
- A customer requests information about their stored data. The response is generally due within one month.
- A notebook with unencrypted customer data is stolen. This is a personal data breach that must be assessed and, if necessary, reported.
- Before introducing a new cloud service, the legal basis, data processing, storage location and, if necessary, a data protection impact assessment are clarified.
- When using AI tools, personal data is reduced or pseudonymized in advance.
What companies should keep in mind
- Keep an up-to-date record of processing activities and define responsibilities.
- Prepare procedures for access requests and data breaches so that deadlines are met.
- Define deletion and retention periods and implement them technically.
- Check service providers, especially for data transfers to countries outside the EEA.
- Check whether a data protection officer must be appointed.
This entry is a general overview and does not replace legal advice.