A Who's Who and a What's What of GDPR

The General Data Protection Regulation (GDPR) is the European Union’s comprehensive law that sets strict rules for how organizations collect, use, and protect EU citizens’ personal data, regardless of where the organization is based. It establishes individual rights, mandates accountability, and turns data privacy from a best practice into a legal obligation with global reach.

“Who’s Who and a What’s What of GDPR” refers to understanding who the key roles are in the General Data Protection Regulation, such as data subjects, controllers, and processors, and what the important GDPR concepts are, like personal data, anonymized data, and more.

What’s What: Key Concepts

Personal Data

Personal data is any information that relates to an individual who can be directly or indirectly identified. Names, email addresses, credit card numbers, date of birth, etcetera are probably the first that come to mind when you think of the definition of personal data. However, location information, such as IP address, or other online identifiers, such as cookie ID, can also be personal data.

Anonymized Data

Anonymized data is personal data that, through the use of technology, has been rendered anonymous so that it is no longer possible to identify an individual through the data, either directly or indirectly, or in combination with other data.

Anonymized data is not personal data and is therefore not covered by the GDPR -provided that the personal data has been anonymized in accordance with the three criteria laid down by the European Data Protection Authorities.

Special Category Data

GDPR classifies the following types of personal data as potentially more sensitive and provides them with additional protection:

The special categories of personal data are:

• Personal data about racial or ethnic origin.

• Personal data about political opinions.

• Personal data about religious or philosophical beliefs.

• Personal data about trade union membership.

• Genetic data.

• Biometric data (where used for identification purposes)—this could be data such as fingerprints or retina scans.

• Data concerning health.

These types of personal data merit specific protection and must be handled with greater care, as using them could create significant risks to an individual’s fundamental rights and freedoms or expose them to discrimination.

Who’s Who: Key Roles

Data Controller

The data controller determines the purposes for which and how personal data is processed. So, if your company or organization decides why and how the personal data should be processed, it is the data controller. Employees process personal data within your organization to fulfill their tasks as data controllers.

Data Processor

A data processor is the individual (other than an employee of the controller) or the legal person that carries out processing activities, on behalf of and in accordance with the controller’s instructions. In other words, the data controller can provide personal data to the data processor to carry out such processing activities on its behalf. A legal agreement governs arrangements between the data controller and the data processor.

Data Subject

A data subject is any individual whose personal data is being collected, processed, or stored. This could include names, email addresses, ID numbers, IP addresses, biometric data, and anything else covered under GDPR’s definition of personal data. Under regulations like GDPR, the data subject is the individual the data refers to and is central to modern data protection laws.

Data Protection Officer

Some data controllers must have a Data Protection Officer (DPO), while others choose to appoint a DPO (or an assigned individual) to handle data protection matters on their behalf. Individuals can also contact the DPO with data protection queries or concerns. If a company has no DPO, other people in the company will address any data protection queries or concerns on behalf of the data controller. Note that these individuals are not data controllers themselves; they are acting on behalf of the data controller.

GDPR Representative

If you do not have an office in the EU/EEA but still process data from individuals based in the EU/EEA, then you still need to comply with the GDPR regarding your data processing, and the GDPR requires you to appoint a representative. This representative must be based in an EU or EEA state where some of the individuals whose personal data you process are located.

You must authorize the representative in writing to act on your behalf for GDPR compliance. Be aware that a Data Representative is not a Data Protection Officer (DPO). It has a distinct role with its own responsibilities. The representative’s role is to ensure that you comply with the GDPR by enabling communication with individuals in Europe and European data protection authorities.

You should provide details of your representative to EEA-based individuals whose personal data you process, typically by including the contact details in your privacy policy. The representative must also be able to act on your behalf with European data protection authorities.

Conclusion

As we’ve explored, GDPR is more than just a set of rules; it’s a fundamental shift in how we approach data protection. It empowers individuals, holds organizations accountable, and aims to create a safer digital environment for all of us. Whether you’re an individual concerned about your privacy or a business striving for compliance, understanding GDPR is crucial in today’s data-driven world.

GDPR compliance is an ongoing journey. It requires continuous attention, adaptation, and improvement. But by embracing its principles and implementing robust data protection practices, we can all contribute to a digital landscape where personal data is respected and protected.