Security & governance
GDPR
The GDPR (General Data Protection Regulation) is the European Union's law on the protection of personal data. It sets rules for how organizations collect, use, store and delete information about identifiable people, gives those people rights over their data, and applies to any organization that handles the personal data of individuals in the EU, wherever the organization is based.
Who does the GDPR apply to?
The regulation has applied since 25 May 2018. It covers organizations established in the EU and organizations outside it that offer goods or services to people in the EU or monitor their behavior. It distinguishes two roles: the controller, which decides why and how personal data is processed, and the processor, which handles data on the controller's behalf. The split is explained under data controller vs. data processor.
Which GDPR principles affect storage?
Several of the regulation's principles translate directly into storage requirements.
| Principle | What it requires | Storage consequence |
|---|---|---|
| Storage limitation | Data kept no longer than necessary | Retention schedules and deletion that actually happens |
| Integrity and confidentiality | Appropriate security | Encryption, access control, resilience |
| Data minimization | Only data that is needed | Fewer copies, including in test and analytics |
| Accountability | Ability to demonstrate compliance | Logs, records of processing, documented controls |
| Right to erasure | Deletion on a valid request | Finding and removing data across replicas and versions |
What does the GDPR say about where data is stored?
The GDPR does not require personal data to stay in the EU. It restricts transfers to countries outside the European Economic Area unless the destination offers adequate protection or safeguards such as standard contractual clauses are in place. In practice, many organizations choose to keep personal data on infrastructure within the EU to avoid transfer assessments, a choice often described as data localization. Access by foreign authorities under laws such as the CLOUD Act is part of the same assessment.
How does the GDPR treat backups and archives?
Personal data in backups and archives is still personal data. Regulators generally accept that an individual record cannot be removed from an immutable backup set, provided the backup expires on a documented schedule and erased data is not restored into production. Long-term archives need a lawful basis and a retention period like any other processing. The security obligation also works in the other direction: the regulation expects the ability to restore availability and access to personal data in a timely manner after an incident, which makes tested backups part of compliance.
Frequently asked questions
What are the penalties under the GDPR?
Supervisory authorities can impose fines of up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher, for the most serious infringements.
Does the GDPR apply to companies outside the EU?
Yes, if they offer goods or services to people in the EU or monitor their behavior there.
Is encryption mandatory under the GDPR?
The regulation requires security appropriate to the risk and names encryption as an example measure. It does not mandate a specific technology.
Related terms
- Data controller vs. data processor: the two roles the regulation defines.
- Data processing agreement (DPA): the contract required between them.
- Data localization: keeping data within a jurisdiction.
- CLOUD Act: a US law relevant to transfer assessments.
- Encryption at rest: a security measure the regulation names.