EU GDPR essentials
Regulation (EU) 2016/679 has applied since 25 May 2018. It can reach businesses outside the EU that offer goods or services to people in the EU or monitor their behaviour (Art. 3(2)).
Last reviewed: 2026-10-18
Not legal advice. This summary is general information prepared by Samtaro Security, a non-law-firm resource of Samtaro Security. It may be incomplete or out of date, and it is no substitute for advice from a lawyer licensed in the relevant jurisdiction. Last reviewed: 18 October 2026.
| Topic | GDPR article | In short |
|---|---|---|
| Territorial scope | Art. 3 | Applies to non-EU controllers that offer goods or services to, or monitor, people in the EU. |
| EU representative | Art. 27 | Non-EU controllers caught by Art. 3(2) generally must appoint a representative in the EU, subject to limited exceptions. |
| Principles | Art. 5 | Lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. |
| Lawful bases | Art. 6 | Consent, contract, legal obligation, vital interests, public task, legitimate interests. |
| Consent | Art. 7 | Must be demonstrable and as easy to withdraw as to give. |
| Transparency | Arts. 12–14 | Privacy information that is concise, intelligible and easily accessible. |
| Processors | Art. 28 | Written contract with required terms. |
| Records | Art. 30 | Record of processing activities. |
| Security | Art. 32 | Appropriate technical and organisational measures. |
| Breach notification | Arts. 33–34 | Notify the supervisory authority without undue delay, and where feasible within 72 hours; notify individuals when the risk is high. |
| DPIA | Art. 35 | Required for processing likely to result in high risk. |
| Fines | Art. 83 | Up to €10m or 2% of worldwide turnover, or €20m or 4% for the most serious infringements, whichever is higher. |
Cookies are a separate rule
Cookie consent in the EU comes mainly from the ePrivacy Directive (2002/58/EC, Art. 5(3)) as implemented in each country's law. The GDPR then governs the personal data that cookies collect. In practice: no non-essential cookies before opt-in, and rejecting must be as easy as accepting.
Find out what your website reveals
Run the free passive mini-scan in under a minute, or ask for a quote for the full report.