# General Data Protection Regulation (GDPR)

> The General Data Protection Regulation (GDPR) is EU Regulation (EU) 2016/679 on the protection of personal data. It has applied directly in all EU member states since 25 May 2018.

- URL: https://saascolumn.com/en/glossary/gdpr/
- Published: 13 November 2026
- Other languages: DE https://saascolumn.com/glossar/dsgvo/

The GDPR governs when businesses may process personal data and which rights data subjects have. Personal data is any information relating to an identifiable person, such as names, email addresses or chat messages.

**Three rules matter most when you use software:**

- Article 28 requires a [data processing agreement](https://saascolumn.com/en/glossary/data-processing-agreement-dpa/) when a provider processes data on your behalf.
- Article 32 requires appropriate technical and organisational security measures.
- Articles 44 et seq. govern transfers to third countries such as the US, for example under the [EU-US Data Privacy Framework](https://saascolumn.com/en/blog/eu-us-data-privacy-framework-saas/).

National laws can add to the regulation, such as the Federal Data Protection Act in Germany. Supervision lies with independent data protection authorities in each member state, which cooperate in the European Data Protection Board.

Infringements can lead to fines. According to the German data protection conference, infringements of the obligations under Article 28 can be fined up to 10 million euros or 2 percent of worldwide annual turnover.

## Sources

1. [Art. 99 GDPR – Entry into force and application](https://gdpr-info.eu/art-99-gdpr/), intersoft consulting
2. [Art. 28 GDPR – Processor (text of Regulation (EU) 2016/679)](https://gdpr-info.eu/art-28-gdpr/), intersoft consulting
3. [Kurzpapier Nr. 13: Auftragsverarbeitung, Art. 28 DS-GVO](https://www.datenschutzkonferenz-online.de/media/kp/dsk_kpnr_13.pdf), Datenschutzkonferenz (DSK), 2018-12-17