General Data Protection Regulation GDPR

The GDPR applies to almost any organisation established in the EU that handles personal data, and to some organisations outside it. Personal data is any information relating to an identified or identifiable natural person (Article 4(1)).

The material scope is in Article 2. The regulation covers processing by automated means. It also covers paper records that form part of a filing system. It does not cover a natural person's purely personal or household activity.

The territorial scope is in Article 3. An organisation established in the EU is covered "regardless of whether the processing takes place in the Union or not". An organisation outside the EU is covered when it offers goods or services to people in the EU, or monitors their behaviour there. The text contains no general exemption for small firms.

The GDPR rests on seven principles in Article 5. Six describe how personal data must be handled. The seventh, accountability, makes the controller responsible for the other six. The table gives each principle with what it requires.

Processing is lawful only if at least one of the six bases in Article 6(1) applies. They are the person's consent, the performance of a contract with that person, a legal obligation on the controller, the protection of someone's vital interests, a task in the public interest, and the legitimate interests of the controller or a third party, unless the person's own interests or fundamental rights override them.

Consent is one basis among six. A professional firm usually relies on others. Work for a client who is an individual rests on the contract. Identity checks that anti-money laundering law demands rest on the legal obligation.

A firm that holds client identity documents meets the GDPR at four points. The first is the document itself. A passport copy is personal data. The firm needs a lawful basis for holding it and may keep only what the purpose requires.

The second is special categories of data. Article 9(1) prohibits the processing of data such as health data and biometric data used to uniquely identify a person, unless an exception in Article 9(2) applies. Facial images that go through specific technical processing to confirm who a person is are biometric data (Article 4(14)). A firm that matches a selfie against a document photo should know which exception it relies on. For firms under the Anti-Money Laundering Regulation, which applies from 10 July 2027, Article 76 allows special categories to be processed where strictly necessary to prevent money laundering and terrorist financing, subject to safeguards.

The third is retention. Personal data may be kept in identifiable form "for no longer than is necessary" for its purpose (Article 5(1)(e)). The Anti-Money Laundering Regulation requires customer due diligence records to be retained for five years after the business relationship ends (Article 77).

The fourth is suppliers. A provider that handles personal data on the firm's behalf is a processor. The firm needs a written contract with each one (Article 28).

The GDPR sets two tiers of administrative fines in Article 83. The first tier covers, among others, the duties in Articles 25 to 39, which include security, processor contracts and breach notification. The ceiling is EUR 10 million or, for an undertaking, 2% of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(4)). The second tier covers the principles, the lawful bases, special categories, data subjects' rights and transfers outside the EU. The ceiling is EUR 20 million or 4%, whichever is higher (Article 83(5)).

These are upper limits. Each fine must be "effective, proportionate and dissuasive" (Article 83(1)). A fine is not the only consequence. Any person who suffers damage from an infringement has a right to compensation from the controller or processor (Article 82).