GDPR stands for General Data Protection Regulation. It's an EU law (“regulation”) on data protection and privacy for all individuals in the European Union and the European Economic Area. Its main purpose is to give individuals more control over their personal data and to harmonize the regulatory environment for businesses.

A Data Protection Officer (DPO) must be appointed if: the processing is carried out by a public authority or body; the core activities of the controller or processor consist of processing operations that require regular and systematic monitoring of data subjects on a large scale; or if the core activities involve processing on a large scale of special categories of data (e.g., health data, racial or ethnic origin, etc.) or data relating to criminal convictions and offenses. In addition to the GDPR requirements, according to the German BDSG, a DPO must also be appointed if a company regularly employs at least 20 people involved in the automated processing of personal data. Furthermore, the appointment of a DPO is mandatory if there are processing operations that require a data protection impact assessment, i.e., those with a high risk to the data subjects.

The Data Protection Officer (DPO) has a control function and supports employees as well as customers with all questions relating to GDPR. They oversee data protection strategy and implementation to ensure compliance. The DPO is your main contact for all data protection related questions.

The GDPR applies to organizations operating within the EU and organizations outside of the EU that offer goods or services to, or monitor the behavior of, EU data subjects. It applies to all companies processing and holding the personal data of data subjects residing in the European Union.

GDPR is extraterritorial in its scope. It applies to any organization based within the EU, regardless of whether the data being processed concerns individuals in the EU or non-EU individuals, such as those from the United States or Australia. So, even if our company, based in the EU, processes data of citizens or individuals from non-EU countries, the data processing is still subject to GDPR rules. It emphasizes the global reach of GDPR and the importance of compliance regardless of the nationality or residence of the data subject.

Personal data is any information that relates to an identified or identifiable individual. Examples include name, email, address, phone number, IP address, and location data. It can be broad and includes any information that can be used directly or indirectly to identify a person. A hashed or encrypted e-mail address uploaded to Facebook Custom Audience might be personal data for them since they can match it with an existing user’s e-mail address.

Under GDPR, organizations must obtain clear and unambiguous consent from individuals before processing their data for marketing purposes or for tracking purposes. This means pre-ticked boxes or inactivity cannot constitute consent. Also, individuals have the right to withdraw their consent at any time.

Non-compliance can result in severe penalties, including fines up to €20 million or 4% of the company’s global annual revenue (whichever is higher). Apart from financial penalties, non-compliance can also damage an organization's reputation. Many well-known data breaches of Tech companies speak for themselves.