WebBuilding

Laws and standards

GDPR

Summary

The General Data Protection Regulation (GDPR), formally Regulation (EU) 2016/679, is the European Union's main law on personal data. It was adopted on April 27, 2016, has applied since May 25, 2018, and replaced the 1995 Data Protection Directive. Under its Article 3 it can also reach websites and businesses outside the EU that offer goods or services to people in the EU or monitor their behavior, with fines of up to €20 million or 4% of worldwide annual turnover.

Web Building Encyclopedia · Laws and standards · Last reviewed October 22, 2026 · 13 min read

What the GDPR is

The General Data Protection Regulation, or GDPR, is a European Union law that sets the rules for how organizations collect, use, store and share information about people. The European Commission calls it “the EU’s main data protection law.”1

Its formal name is Regulation (EU) 2016/679. The European Parliament and the Council of the EU adopted it on April 27, 2016. It was published on May 4, 2016, and entered into force on May 24, 2016.2 Its rules have applied since May 25, 2018, two years after it entered into force.3

The GDPR is a regulation, the kind of EU law that applies directly in every member state. The Commission’s guidance published early in 2018 was framed around the GDPR’s direct application from May 25, 2018.4 The Commission says the law was meant to reduce the fragmentation between national data protection systems.3

The law protects personal data: any information about an identified or identifiable living person, whom the GDPR calls the data subject. The Commission’s examples include names, home and email addresses, IP addresses, cookie IDs and advertising identifiers. Data that has been made anonymous for good is not personal data, but data that is only pseudonymized or encrypted still counts if it can be linked back to a person.1 (An IP address is the number that identifies a device on the internet, and an HTTP cookie is a small file a website stores in the visitor’s browser.)

Processing means almost anything done with that data, from collecting and storing it to sharing and deleting it. The rules are technology neutral, so they cover paper files and video recordings as well as computer systems.1

The GDPR splits responsibility between two roles. A controller decides why and how personal data is processed. A processor handles data on the controller’s behalf and follows its documented instructions. The Commission’s example is a brewery (the controller) that hires a payroll company (the processor).1 On a website, a web host or newsletter service that handles visitors’ data only on the site owner’s instructions fits the processor description.

Two things are outside the law: processing by a person for purely personal or household reasons, and data about people who have died.1

From the 1995 directive to the GDPR

The GDPR replaced Directive 95/46/EC, the EU’s earlier data protection law. That directive was adopted on October 24, 1995, and published on November 23, 1995.5 A directive sets goals that each member state writes into its own national law, which is why the Commission later pointed to fragmentation between national systems as a problem the GDPR would address.3

The European Commission proposed the new regulation in 2012, in a document numbered COM(2012) 11. Its explanatory memorandum notes that the 1995 directive was adopted with two objectives in mind.6 The directive’s title names them: protecting individuals when their personal data is processed, and the free movement of that data.5 It added that “Rapid technological developments have brought new challenges for the protection of personal data.”6

The regulation adopted in 2016 states in its full title that it repeals Directive 95/46/EC.2 EUR-Lex lists May 24, 2018, the day before the GDPR began to apply, as the end of the directive’s validity.5 The Commission published guidance on January 24, 2018, called “Stronger protection, new opportunities,” to prepare for the change.4

Two companion laws sit alongside it. Directive (EU) 2016/680, the Law Enforcement Directive, covers police and criminal justice authorities. Regulation (EU) 2018/1725 covers the EU’s own institutions and has applied since December 11, 2018.3

Who it applies to, including sites outside the EU

Article 3 of the GDPR sets its territorial scope, meaning the places and organizations it reaches. It has two main tests, which the European Data Protection Board (EDPB), the body of EU data protection authorities, explains in its guidelines on Article 3.7

  • Establishment. Article 3(1) covers processing in the context of the activities of an establishment of a controller or processor in the EU, “regardless of whether the processing takes place in the Union or not.”7 An EU business that stores its customer data on servers in another country is still covered.
  • Targeting. Article 3(2) covers controllers and processors with no EU establishment when they process data of people in the EU and the processing relates to offering them goods or services, paid or free, or to monitoring their behavior in the EU.71

The targeting test is why a website run from the United States or anywhere else can fall under the GDPR. It depends on where people are when they use the site, not on their citizenship or residence.7 The EDPB gives the example of a US news app aimed only at the US market: when a US tourist uses it in Europe, the company’s collection of that tourist’s data is not subject to the GDPR.7 The Commission likewise says a non-EU provider that does not specifically target people in the EU is not covered.1

Being reachable from Europe is not enough. Recital 23 of the GDPR, quoted in the guidelines, says the mere accessibility of a website in the EU does not show an intention to offer goods or services there.7 The EDPB lists signs that can point to targeting, alone or together:7

  • naming the EU or a member state in connection with what is offered
  • paying a search engine or running ad campaigns aimed at an EU audience
  • a top-level domain such as .de or .eu, or EU addresses and phone numbers
  • a language or currency used in one or more EU countries
  • delivering goods to EU countries, or giving travel instructions from them

Monitoring covers tracking people on the internet. The EDPB’s examples include behavioral advertising, cookies or fingerprinting, geolocation for marketing and personalized health analytics, though it adds that not every online collection of data counts as monitoring.7

When Article 3(2) applies, it applies only to the processing linked to that targeting or monitoring, but all of the regulation’s provisions apply to that processing. A non-EU organization caught by it must also name a representative in the EU in writing, unless its processing is occasional, does not involve large-scale processing of sensitive or criminal-offence data and is unlikely to put people at risk.7

Small businesses are not exempt. The Commission says small and medium-sized enterprises must comply, although some obligations fall away when processing is not a core part of the business or is unlikely to create risks.1

What the GDPR requires

Principles and lawful bases

The GDPR sets seven principles for all processing: lawfulness, fairness and transparency; purpose limitation; data minimization; storage limitation; accuracy; integrity and confidentiality; and accountability.1 Data minimization means collecting only the data needed for the purpose.

Every use of personal data also needs a legal ground, often called a lawful basis. The Commission lists six:8

  1. the person has given consent
  2. processing is needed to perform a contract with the person
  3. processing is needed to meet a legal obligation
  4. processing is needed to protect someone’s vital interests
  5. processing is needed for a task in the public interest
  6. processing is needed for the organization’s legitimate interests, but only after checking that the person’s fundamental rights and freedoms are not seriously affected

Consent

Consent is only one of the six bases, but it is the one most visible on websites. To be valid it must be freely given, informed, specific to a purpose and expressed through a clear positive act, such as ticking a box the person has to check themselves.9 Withdrawing consent must be as easy as giving it, and the organization must be able to prove that the person agreed.8

When a child’s data is processed on the basis of consent, a parent or guardian must give explicit consent below an age that each member state sets between 13 and 16.10

Rights of individuals

The Commission lists eight rights for data subjects: to be informed, of access, to rectification, to erasure, to restriction of processing, to data portability, to object, and rights related to automated decision-making and profiling.1 Organizations must answer requests without undue delay and in principle within one month, free of charge. They may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive, such as repeated ones.11

The right to be informed is why websites publish privacy notices. At the time data is collected, people must be told who the controller is, the purposes and legal basis, how long data is kept, who receives it, whether it leaves the EU, their rights, and their right to complain to a data protection authority, all in clear and plain language.12

Data breaches

A personal data breach is a security incident that leads, for example, to the accidental or unlawful destruction or loss of personal data. If a breach is likely to pose a risk to people, the controller must notify its data protection authority no later than 72 hours after becoming aware of it, and give reasons if the notice is late. If the risk is high, the people affected must also be told as soon as possible. Every breach must be recorded, even when no notice is needed.13

Enforcement and fines

National data protection authorities monitor compliance and can investigate.14 Depending on the case, an authority can issue a warning or a reprimand, order a temporary or permanent ban on processing, or impose a fine of up to €20 million or 4% of a business’s total worldwide annual turnover.15 The EDPB notes that the higher of the two amounts applies.14 Authorities weigh the nature, gravity and duration of the infringement, whether it was intentional or negligent, and how well the organization cooperated.15

In its second report on the GDPR, dated July 25, 2024, the Commission said authorities had imposed over 6,680 fines totaling around €4.2 billion, and that they receive over 100,000 complaints a year. Ireland’s authority accounted for about €2.8 billion of that total.416 One of those fines, €1.2 billion against Meta Ireland in 2023, concerned transfers of data to the United States and is described below.17

Most cookie banners exist because of a second law, the ePrivacy Directive. Its formal name is Directive 2002/58/EC, and it was adopted on July 12, 2002.18 Its Article 5(3) governs storing information on, or reading it from, a user’s device, which covers cookies and similar tracking technologies.19

The two laws meet in the definition of consent. In the Planet49 case, decided on October 1, 2019, the Court of Justice of the European Union (CJEU) read Article 5(3) of the ePrivacy Directive together with the GDPR’s definition of consent in Article 4(11) and its consent basis in Article 6(1)(a).19 The Court ruled that:19

  • consent to cookies is not valid if it is collected with a pre-checked checkbox that the user must untick to refuse
  • the rule applies the same way whether or not the information stored on the device is personal data
  • the information given to users must include how long the cookies will operate and whether third parties can access them

A site owner can also share responsibility for data that a third party collects through its pages. In Fashion ID, decided on July 29, 2019, the CJEU held that a website operator that embeds a social plugin, in that case Facebook’s Like button, can be a controller for the collection and transmission of visitors’ data, though not for what the plugin’s owner does with it afterward.20 That case was decided under the 1995 directive.20

National authorities apply the cookie rules and can differ in detail. France’s CNIL, for example, exempts audience measurement cookies from consent only under strict conditions, including use for a single site, no cross-linking with other data, truncated IP addresses and a lifetime of no more than 13 months. It says most large analytics offerings do not fall within the exemption, and it names Matomo as open source software that can be configured to meet it.21

Data transfers to the United States

Chapter V of the GDPR sets the conditions for sending personal data from the EU and the wider European Economic Area (EEA) to other countries.22 One route is an adequacy decision, in which the Commission finds that a country’s level of protection is adequate. Another is standard contractual clauses (SCCs), contract terms adopted by the Commission.2217 Transfers to the United States have been the subject of three Commission frameworks and two major court rulings.

  • Safe Harbour. On October 6, 2015, in a case brought by Maximillian Schrems, the CJEU declared the Commission’s 2000 Safe Harbour decision (Decision 2000/520) invalid.23
  • Privacy Shield. On July 16, 2020, in the case known as Schrems II, the CJEU ruled on its replacement, Implementing Decision (EU) 2016/1250.24 The EDPB summarized the result: the Court declared the Privacy Shield adequacy decision invalid without keeping its effects for a grace period. SCCs remained valid, but each transfer has to be assessed case by case, and some may need supplementary measures on top of the clauses.22
  • Data Privacy Framework. On July 10, 2023, the Commission adopted Implementing Decision (EU) 2023/1795, finding that the EU-US Data Privacy Framework provides adequate protection.25 Personal data can now flow from the EU to US companies that take part in the framework. The Commission links it to new US limits on signals intelligence and an independent redress mechanism for people in the EU.26

The gap between frameworks had a cost. Ireland’s Data Protection Commission announced on May 22, 2023, a €1.2 billion fine against Meta Ireland for transferring Facebook users’ data to the US under SCCs that it found did not address the risks the CJEU had identified. It also ordered Meta to suspend those transfers. The decision followed a binding decision of the EDPB.17

The new framework has itself been challenged. On September 3, 2025, the General Court, the EU’s lower court, gave judgment in Latombe v Commission, a case brought by Philippe Latombe.27 It dismissed his action to annul the adequacy decision.28 The court assessed the decision on the basis of the facts and the law as they stood when it was adopted in 2023.27 Latombe appealed to the Court of Justice on October 31, 2025, in Case C-703/25 P.29

Changes in 2025 and 2026

Two newer measures affect how the GDPR works. One has been adopted, and the other is still a proposal.

Procedural rules for cross-border cases. Regulation (EU) 2025/2518, adopted on November 26, 2025, adds procedural rules for enforcing the GDPR. It entered into force on January 1, 2026, but its rules apply only from April 2, 2027.30 It sets out what a cross-border complaint must contain to be admissible, gives the parties under investigation a right to be heard on an authority’s preliminary findings, and generally gives the lead authority 15 months from confirming it is competent to submit a draft decision, a limit it can extend once by up to 12 months in complex cases.30

The Digital Omnibus. On November 19, 2025, the Commission published a Digital Omnibus proposal, described as “a set of technical amendments to a large corpus of digital legislation.”31 It would amend the GDPR, the ePrivacy Directive and several other laws.32 For the GDPR it proposed, among other things, to add to the definition of personal data so that information may not count as personal data for an entity that cannot identify the person, to require breach notices to authorities only for breaches likely to pose a high risk, to extend the deadline from 72 to 96 hours, and to create a single entry point for notices.32

The EDPB and EDPS adopted a joint opinion on February 10, 2026.32 They said that change would narrow the concept of personal data and urged lawmakers not to adopt it, supported the changes to breach notices, and supported a solution to cookie banner fatigue that includes machine-readable signals of users’ choices.33

On October 21, 2026, the Council of the EU, which represents member state governments, agreed its negotiating position. It keeps the current definition of personal data, backs a longer breach deadline and proposes a single EU-wide list of high-risk processing. For cookies it keeps the rules in the ePrivacy Directive but adds purposes that would not need consent, such as providing a service, audience measurement and device security, with the stated aim of fewer banners.34 Talks with the European Parliament begin once Parliament adopts its own position.34

As of October 22, 2026, the Digital Omnibus changes to the GDPR and the cookie rules have not become law, so the 72-hour breach deadline and the current cookie consent rules still apply.3413

Timeline

  1. The Council of the EU agrees its position on the Digital Omnibus changes to the GDPR and cookie rules34
  2. The EDPB and EDPS adopt a joint opinion on the Digital Omnibus32
  3. Regulation (EU) 2025/2518 on GDPR enforcement procedures enters into force30
  4. The European Commission publishes the Digital Omnibus proposal31
  5. The General Court dismisses the Latombe challenge to the EU-US Data Privacy Framework28
  6. The Commission publishes its second report on the application of the GDPR4
  7. The Commission adopts its adequacy decision for the EU-US Data Privacy Framework25
  8. Ireland's Data Protection Commission announces a €1.2 billion fine against Meta Ireland17
  9. The CJEU invalidates the Privacy Shield in Schrems II24
  10. The CJEU rules in Planet49 that pre-ticked boxes are not valid cookie consent19
  11. The GDPR begins to apply across the EU3
  12. The GDPR enters into force2
  13. The European Parliament and the Council adopt the GDPR2
  14. The CJEU declares the Safe Harbour decision invalid in Schrems I23
  15. Directive 95/46/EC, the GDPR's predecessor, is adopted5

What it means for your website

This section is general information, not legal advice. If your site collects data from people in the EU, a lawyer or your national data protection authority can tell you how the rules apply to you.

  • Check whether the GDPR reaches you. If you are outside the EU, the question is whether you target people in the EU, for example with EU languages, currencies, shipping or ads, or monitor their behavior with tracking.7 If you also serve US visitors, see our guide to website laws in the US and the entry on the CCPA and CPRA.
  • List what you collect. Contact forms, newsletter sign-ups, order data, analytics and ad pixels all collect personal data, since IP addresses and cookie IDs count.1 Ask only for fields you need.1
  • Publish a clear privacy notice. Say who you are, why you collect each kind of data, your legal basis, how long you keep it, who receives it, whether it leaves the EU and how people can use their rights.12
  • Get cookie consent right. Do not pre-tick boxes, tell visitors how long cookies last and whether third parties can read them, and make refusing or withdrawing as easy as accepting.198 Load non-essential tags only after consent.
  • Review analytics and ads. Google’s EU user consent policy requires consent for cookies where the law requires it and for ad personalization for users in the EEA, the UK and Switzerland.35 Our page on websites and Google Ads covers conversion tracking. For lighter analytics, the CNIL describes when a self-configured tool can avoid a consent banner in France.21
  • Choose plugins and embeds carefully. Every plugin, chat widget or social button that sends visitor data to another company adds a party to your notice and, after Fashion ID, can make you a controller for that collection.20 On self-hosted WordPress, which we build on every week, form and analytics plugins are where most of this data lives.
  • Plan for a breach. Know who would call your host and your data protection authority, because the 72-hour clock starts when you become aware of the breach.13

See also

References

  1. Data protection explained. European Commission. accessed October 22, 2026.
  2. Regulation (EU) 2016/679 (General Data Protection Regulation). EUR-Lex, Publications Office of the European Union. 2016-04-27. accessed October 22, 2026.
  3. Legal framework of EU data protection. European Commission. accessed October 22, 2026.
  4. Reports on the application of the GDPR. European Commission. accessed October 22, 2026.
  5. Directive 95/46/EC on the protection of individuals with regard to the processing of personal data. EUR-Lex, Publications Office of the European Union. 1995-10-24. accessed October 22, 2026.
  6. Proposal for a General Data Protection Regulation, COM(2012) 11 final. European Commission, via EUR-Lex. 2012. accessed October 22, 2026.
  7. Guidelines 3/2018 on the territorial scope of the GDPR (Article 3), version 2.1. European Data Protection Board. 2019-11-12. accessed October 22, 2026.
  8. Legal grounds for processing data. European Commission. accessed October 22, 2026.
  9. When is consent valid?. European Commission. accessed October 22, 2026.
  10. Are there any specific safeguards for data about children?. European Commission. accessed October 22, 2026.
  11. How should requests from individuals exercising their data protection rights be dealt with?. European Commission. accessed October 22, 2026.
  12. What information must be given to individuals whose data is collected?. European Commission. accessed October 22, 2026.
  13. Personal data breaches: what to do (Guidelines at a glance). European Data Protection Board. 2025-03. accessed October 22, 2026.
  14. What are the sanctions if my organisation does not comply with the GDPR or if my processing violates the GDPR?. European Data Protection Board, Data Protection Guide for Small Business. accessed October 22, 2026.
  15. What if my company/organisation fails to comply with the data protection rules?. European Commission. accessed October 22, 2026.
  16. Second Report on the application of the General Data Protection Regulation, COM(2024) 357. European Commission, via EUR-Lex. 2024-07-25. accessed October 22, 2026.
  17. Data Protection Commission announces conclusion of inquiry into Meta Ireland. Data Protection Commission (Ireland). 2023-05-22. accessed October 22, 2026.
  18. Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector. EUR-Lex, Publications Office of the European Union. 2002-07-12. accessed October 22, 2026.
  19. Judgment in Case C-673/17, Bundesverband der Verbraucherzentralen v Planet49 GmbH. Court of Justice of the European Union, via EUR-Lex. 2019-10-01. accessed October 22, 2026.
  20. Judgment in Case C-40/17, Fashion ID GmbH and Co. KG v Verbraucherzentrale NRW eV. Court of Justice of the European Union, via EUR-Lex. 2019-07-29. accessed October 22, 2026.
  21. Sheet n°16: Use analytics on your websites and applications. CNIL (French data protection authority). 2020-06-11. accessed October 22, 2026.
  22. Frequently Asked Questions on the judgment of the Court of Justice of the European Union in Case C-311/18. European Data Protection Board. 2020-07-23. accessed October 22, 2026.
  23. Judgment in Case C-362/14, Maximillian Schrems v Data Protection Commissioner. Court of Justice of the European Union, via EUR-Lex. 2015-10-06. accessed October 22, 2026.
  24. Judgment in Case C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems. Court of Justice of the European Union, via EUR-Lex. 2020-07-16. accessed October 22, 2026.
  25. Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection of personal data under the EU-US Data Privacy Framework. EUR-Lex, Publications Office of the European Union. 2023-07-10. accessed October 22, 2026.
  26. EU-US data transfers. European Commission. accessed October 22, 2026.
  27. Judgment in Case T-553/23, Latombe v Commission. General Court of the European Union, via EUR-Lex. 2025-09-03. accessed October 22, 2026.
  28. Case T-553/23: Judgment of the General Court of 3 September 2025, Latombe v Commission (summary and operative part). Official Journal of the European Union, via EUR-Lex. 2025-10-20. accessed October 22, 2026.
  29. Case C-703/25 P: Appeal brought on 31 October 2025 by Philippe Latombe. Official Journal of the European Union, via EUR-Lex. 2025-10-31. accessed October 22, 2026.
  30. Regulation (EU) 2025/2518 laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679. EUR-Lex, Publications Office of the European Union. 2025-11-26. accessed October 22, 2026.
  31. Digital Omnibus Regulation Proposal. European Commission, Shaping Europe's digital future. 2025-11-19. accessed October 22, 2026.
  32. EDPB-EDPS Joint Opinion 2/2026 on the Digital Omnibus Proposal. European Data Protection Board and European Data Protection Supervisor. 2026-02-10. accessed October 22, 2026.
  33. Digital Omnibus: EDPB and EDPS support simplification and competitiveness while raising key concerns. European Data Protection Board and European Data Protection Supervisor. 2026-02-11. accessed October 22, 2026.
  34. Digital rulebook: Council agrees position to simplify data protection, privacy and cyber reporting rules. Council of the European Union. 2026-10-21. accessed October 22, 2026.
  35. EU user consent policy. Google. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].