The GDPR governs when businesses may process personal data and which rights data subjects have. Personal data is any information relating to an identifiable person, such as names, email addresses or chat messages.
Three rules matter most when you use software:
Article 28 requires a data processing agreement when a provider processes data on your behalf.
Article 32 requires appropriate technical and organisational security measures.
Articles 44 et seq. govern transfers to third countries such as the US, for example under the EU-US Data Privacy Framework.
National laws can add to the regulation, such as the Federal Data Protection Act in Germany. Supervision lies with independent data protection authorities in each member state, which cooperate in the European Data Protection Board.
Infringements can lead to fines. According to the German data protection conference, infringements of the obligations under Article 28 can be fined up to 10 million euros or 2 percent of worldwide annual turnover.