What is the GDPR?

GDPR: definition and scope

The General Data Protection Regulation applies directly in all EU member states and is supplemented in Germany by the Federal Data Protection Act (BDSG). It covers every processing of personal data, meaning any information relating to an identifiable person—from a name and email address to an IP address, photos and customer numbers. Small businesses, associations and self-employed professionals are covered as well.

The basic principle is a ban with a permission requirement: data may be processed only if there is a legal basis. These include above all consent, performance of a contract, a legal obligation and legitimate interests (Art. 6 GDPR). Stricter rules apply to special categories such as health data. The regulation also reaches providers outside the EU that offer goods or services to people in the EU.

Principles and rights of data subjects

Art. 5 GDPR sets out the principles: lawfulness and transparency, purpose limitation, data minimization, accuracy, storage limitation, and integrity and confidentiality. Companies must be able to demonstrate compliance (accountability). In practice, this means that decisions, contracts and safeguards are documented so they can be proven to supervisory authorities and individuals.

Data subjects have the right to information, access, rectification, erasure, restriction of processing, data portability and objection. Requests must generally be answered within one month, with an extension possible in justified cases. That is why every company needs a clear internal process for who receives, reviews and answers such requests.

Real-world example: a heating contractor with a website and cloud software

A typical scenario: a heating contractor with twelve employees runs a website with a contact form, uses a newsletter tool, keeps customer data in cloud software and has embedded Google Maps. A review shows that the privacy notice does not mention the newsletter tool, there is no data processing agreement with the cloud provider, and the map transmits data as soon as the page loads.

The fix consists of four steps: record the processing activities, conclude the missing contracts, load the map only after consent and update the privacy notice. The effort is manageable—far less than dealing with a complaint to the supervisory authority or a cease-and-desist letter. It is important to document the points afterwards and to check them again whenever new tools are added.

Obligations, fines and common mistakes

Supervisory authorities can impose fines of up to €20 million or 4 percent of worldwide annual turnover, whichever is higher; a lower range applies to certain formal obligations. Affected individuals may also claim damages. In practice, proceedings often begin with a complaint from a data subject.

• Service providers with data access but no data processing agreement
• Tracking, maps or videos loaded before consent is given
• A privacy notice copied from a template that does not fit the website
• No retention periods: data stays in the system indefinitely
• No process for access requests and data breaches (notification within 72 hours)

What companies should look out for

Start with an inventory: what data arises where, who has access, which service providers are involved? This produces the record of processing activities, contracts, deletion concept and privacy notice. Data protection belongs in the planning of new software from the start (privacy by design). Nano Concepts supports the technical implementation, for example consent solutions, hosting in Germany and role concepts. This article does not replace legal advice.