What is GDPR? A complete guide for businesses

GDPR, or General Data Protection Regulation, is a European Union regulation that has fundamentally changed the rules for processing personal data since May 2018. Whether you run an e-commerce store, a SaaS product, a blog with a newsletter or a simple company website, GDPR almost certainly applies to you. In this comprehensive guide we break down exactly what GDPR means for businesses, what your obligations are and how to achieve practical compliance without drowning in legal jargon.

What is GDPR and why was it created?

The General Data Protection Regulation (Regulation (EU) 2016/679) is a legal framework adopted by the European Parliament and Council in April 2016, with enforcement beginning on 25 May 2018. It replaced the 1995 Data Protection Directive (95/46/EC), which had been drafted before the internet became a mainstream commercial channel and was woefully inadequate for the era of cloud computing, social media, behavioural advertising and big data.

The driving forces behind GDPR were threefold. First, the European Commission wanted to harmonise data protection law across all member states so that businesses would face a single set of rules rather than 28 different national implementations. Second, the regulation was designed to strengthen the rights of individuals: giving EU residents genuine control over how their personal information is collected, stored, shared and deleted. Third, GDPR introduced meaningful enforcement mechanisms, including fines of up to 4% of global annual turnover, to ensure that data protection would be taken seriously at the boardroom level.

In practical terms, GDPR governs any operation performed on personal data: from collection and recording to structuring, storage, alteration, retrieval, consultation, use, disclosure, alignment, restriction, erasure and destruction. If your business touches personal data in any way, the regulation sets the boundaries within which you must operate.

Who does GDPR apply to?

GDPR has an intentionally broad scope. It applies to:

All organisations established in the EU: regardless of whether the actual data processing takes place within the EU or elsewhere.
Organisations outside the EU that offer goods or services to EU residents: if your website targets EU customers (for example, by displaying prices in euros or offering shipping to EU countries), you are subject to GDPR.
Organisations outside the EU that monitor the behaviour of EU residents: if you track website visitors from the EU using cookies, analytics or similar technologies, GDPR applies.

In practice, this means that virtually every business with a web presence is caught by the regulation. If you have a website that uses Google Analytics, embeds a Facebook pixel, collects email addresses through a contact form or sets any cookies beyond those strictly necessary for the site to function, you have GDPR obligations.

Controllers vs. processors

GDPR distinguishes between data controllers (the entity that determines the purposes and means of processing) and data processors (the entity that processes data on behalf of the controller). As a website owner, you are typically the controller. Your hosting provider, analytics platform and email marketing service are processors. You must have a Data Processing Agreement (DPA) in place with each processor, and you remain responsible for ensuring that they handle data in compliance with GDPR.

What counts as personal data?

GDPR defines personal data very broadly. It includes any information relating to an identified or identifiable natural person. Examples include:

Names, email addresses and phone numbers
IP addresses and cookie identifiers
Location data and device fingerprints
Online identifiers such as usernames and account IDs
Behavioural data collected through website analytics
Pseudonymised data that can be re-identified with additional information

The Court of Justice of the EU has confirmed in multiple rulings: including the landmark Breyer case (C-582/14, October 2016): that dynamic IP addresses constitute personal data when the website operator has the legal means to identify the user. This means that even basic server logs can fall within the scope of GDPR.

The six fundamental principles of GDPR

Article 5 of the regulation lays down six principles that must guide all data processing activities:

1. Lawfulness, fairness and transparency: You must have a valid legal basis for processing (such as consent, contractual necessity or legitimate interest) and you must inform individuals clearly about what you do with their data. Privacy policies written in impenetrable legalese do not satisfy the transparency requirement.

2. Purpose limitation: Data may only be collected for specified, explicit and legitimate purposes. You cannot collect email addresses for order confirmations and then use them for marketing without separate consent.

3. Data minimisation: Only collect the data you actually need for the stated purpose. If you do not need a customer's date of birth to process their order, do not ask for it.

4. Accuracy: Personal data must be accurate and kept up to date. You should have processes in place for correcting or deleting inaccurate records.

5. Storage limitation: Data must not be kept in identifiable form for longer than is necessary. Define retention periods for each category of data and enforce them.

6. Integrity and confidentiality (security): You must implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss and destruction. This includes encryption, access controls, regular backups and security testing.

Legal bases for processing personal data

One of the most important practical aspects of GDPR is that every processing activity must be grounded in one of six legal bases defined in Article 6:

Consent: The individual has given clear, affirmative consent for a specific purpose. This is the basis most commonly used for marketing cookies and email newsletters.
Contractual necessity: Processing is necessary to perform a contract with the individual (e.g., processing a customer's address to deliver their order).
Legal obligation: Processing is required to comply with the law (e.g., retaining invoices for tax purposes).
Vital interests: Processing is necessary to protect someone's life. Rarely applicable in a business context.
Public interest: Processing is necessary for a task carried out in the public interest. Primarily relevant for public bodies.
Legitimate interest: Processing is necessary for the legitimate interests of the controller, provided these are not overridden by the individual's rights. This is a flexible basis but requires a documented balancing test (Legitimate Interest Assessment).

For cookies and online tracking, consent is almost always the required legal basis for anything beyond strictly necessary cookies. The Planet49 ruling (C-673/17, October 2019) confirmed that this consent must be active (opt-in), not passive (pre-ticked boxes).

Rights of data subjects

GDPR grants individuals a comprehensive set of rights that your business must be prepared to honour:

Right of access (Article 15): Individuals can request a copy of all personal data you hold about them. You must respond within 30 days.
Right to rectification (Article 16): Individuals can ask you to correct inaccurate data.
Right to erasure / right to be forgotten (Article 17): Individuals can request deletion of their data in certain circumstances, such as when the data is no longer necessary for the original purpose or when they withdraw consent.
Right to restriction of processing (Article 18): Individuals can ask you to limit how you use their data.
Right to data portability (Article 20): Individuals can request their data in a structured, machine-readable format and have it transferred to another controller.
Right to object (Article 21): Individuals can object to processing based on legitimate interest or for direct marketing purposes.

In practice, the most common requests businesses receive are access requests and deletion requests. You should have a documented process for handling these, including identity verification, and ensure you can respond within the 30-day deadline.

What fines can be imposed for GDPR violations?

GDPR introduced a two-tier penalty structure that was deliberately designed to make non-compliance financially painful:

Lower tier: Up to EUR 10 million or 2% of annual worldwide turnover (whichever is greater) for violations relating to controller/processor obligations, certification bodies and monitoring bodies.

Upper tier: Up to EUR 20 million or 4% of annual worldwide turnover (whichever is greater) for violations of fundamental processing principles, consent requirements, data subject rights and international transfer rules.

The largest fine to date is EUR 1.2 billion, imposed on Meta by the Irish Data Protection Commission in May 2023 for unlawful transatlantic data transfers. Amazon received a EUR 746 million fine from the Luxembourg CNPD in 2021 for processing personal data for advertising without valid consent. Google has been fined multiple times, including EUR 150 million by the French CNIL for dark patterns in its cookie banner.

But fines are not reserved for tech giants. In 2024 alone, the Spanish AEPD issued hundreds of fines to small and medium-sized businesses, some as low as EUR 1,000. In the Czech Republic, GDPR compliance is overseen by the Office for Personal Data Protection (UOOU), which has been steadily increasing the frequency and severity of its enforcement actions.

GDPR and cookies: the practical connection

For most website owners, the most visible GDPR obligation is cookie consent. Under the ePrivacy Directive (which works alongside GDPR), you must obtain informed, freely given consent before placing any cookies that are not strictly necessary for the website to function. This includes:

Analytics cookies (Google Analytics, Hotjar, Mixpanel)
Advertising cookies (Google Ads, Facebook Pixel, LinkedIn Insight Tag)
Functional cookies that store user preferences (unless essential to a service the user explicitly requested)

Your cookie banner must provide clear information about what cookies you use, allow users to accept or reject each category, and must not load any non-essential cookies until consent is given. Pre-ticked checkboxes, cookie walls and "by continuing to browse you agree" notices are all non-compliant.

Data Protection Officer: do you need one?

GDPR requires the appointment of a Data Protection Officer (DPO) in three cases: when processing is carried out by a public authority, when your core activities involve regular and systematic monitoring of individuals on a large scale, or when your core activities involve large-scale processing of special categories of data (such as health data or biometric data). Most small and medium-sized businesses do not need a DPO, but it is good practice to designate someone with responsibility for data protection compliance.

Data breach notification

If your business suffers a personal data breach: such as a hack, accidental disclosure or loss of a device containing personal data: GDPR requires you to notify your national DPA within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals' rights. If the breach is likely to result in a high risk, you must also notify the affected individuals without undue delay. Having an incident response plan in place before a breach occurs is essential.

International data transfers

Transferring personal data outside the EU is one of the most complex areas of GDPR. Following the Schrems II ruling (July 2020), which invalidated the EU-US Privacy Shield, businesses must use alternative mechanisms such as Standard Contractual Clauses (SCCs) supplemented by a Transfer Impact Assessment. The EU-US Data Privacy Framework, adopted in July 2023, provides a new adequacy basis for transfers to certified US organisations, but its long-term stability remains uncertain.

For website owners, this is relevant whenever you use US-based services such as Google Analytics, Mailchimp or HubSpot. Ensure that your processors have either self-certified under the Data Privacy Framework or that you have appropriate SCCs in place.

How to achieve GDPR compliance: a practical checklist

For most websites and online businesses, the following steps will cover the essentials:

Implement a compliant cookie banner: One that blocks non-essential cookies until consent is given, provides granular category controls and stores timestamped consent records.
Publish a clear privacy policy: Written in plain language, covering all processing activities, legal bases, data retention periods, third-party sharing and data subject rights.
Audit your cookies and tracking: Know exactly what cookies your website sets, who sets them and for what purpose. Repeat this audit regularly, especially after adding new tools or integrations.
Secure your data: Use HTTPS, encrypt sensitive data at rest, implement access controls and keep your software up to date.
Put DPAs in place with all processors: Every service that processes personal data on your behalf needs a formal Data Processing Agreement.
Establish procedures for data subject requests: Make it easy for users to exercise their rights and ensure you can respond within 30 days.
Document everything: GDPR's accountability principle (Article 5(2)) requires you to be able to demonstrate compliance. Maintain records of processing activities, consent records and your decision-making rationale.
Train your team: Everyone who handles personal data should understand the basics of GDPR and your organisation's policies.

Common myths about GDPR

Several misconceptions persist:

"GDPR only applies to large companies": False. It applies to any organisation that processes personal data of EU residents, regardless of size.
"We are based outside the EU, so GDPR does not apply": False. If you target EU customers or monitor EU residents' behaviour, you are subject to the regulation.
"Consent is the only legal basis": False. There are six legal bases. Consent is important for cookies and marketing, but contractual necessity and legitimate interest are often more appropriate for other processing activities.
"We just need a cookie banner and we are compliant": False. A cookie banner is one piece of the puzzle. Compliance requires a holistic approach covering policies, procedures, security and documentation.

Getting started with Consentio

GDPR compliance does not have to be overwhelming. Consentio provides a complete cookie consent solution that handles the technical complexity for you. Our platform automatically scans your website for cookies, generates a categorised cookie list, blocks non-essential cookies until consent is given, supports Google Consent Mode v2, stores consent records for accountability and lets users change their preferences at any time. Setup takes about five minutes: a single line of code and your cookie compliance is sorted.

Whether you are just starting your GDPR journey or looking to upgrade from a non-compliant solution, Consentio gives you the tools to get it right.