What is the GDPR?

Since its entry into force on May 25, 2018, every online form, customer file, and newsletter sent from the European Union falls under the same reference text. The General Data Protection Regulation (GDPR) remains the framework that lawyers, Data Protection Officers (DPOs), developers, and marketing managers consult every week. It guides their technical, contractual, and commercial choices.

Yet many professionals apply it in fragments: a cookie banner here, a contractual clause there. The overall logic eludes them. However, the text forms a coherent system. General principles produce individual rights, these rights create obligations for organizations, and graduated sanctions ensure compliance.

Understanding what the GDPR is therefore means grasping this architecture rather than memorizing a list of constraints. The following sections revisit each level of this structure: its origins, its principles, the rights it grants, the responsibilities it imposes, and how the CNIL (French Data Protection Authority) enforces it in France. For an SME as much as for a listed group, the practical stakes are the same.

Origins and fundamental objectives of the GDPR

The GDPR, or Regulation (EU) 2016/679, was adopted on April 27, 2016, by the European Parliament and the Council. It came into effect on May 25, 2018. It replaces Directive 95/46/EC, designed at a time when commercial web was in its infancy and social networks did not exist. This directive had to be transposed by each Member State, resulting in 28 national legislations with divergent requirements.

The choice of a regulation, directly applicable, addresses this fragmentation. A company based in Lyon that sells in Spain and Belgium now applies the same rules everywhere. France already had a strong tradition with the Informatique et Libertés (Data Protection) Law of January 6, 1978. This law was overhauled in 2018 to align with the regulation and govern the margins left to States, such as the age of digital consent, set at 15 in France.

The text pursues two explicit objectives in its Article 1. It protects natural persons with regard to the processing of their personal data. It also guarantees the free movement of such data within the internal market. Its territorial scope, defined in Article 3, extends to actors established outside the Union when they target or monitor European residents.

The key principles of data protection

Article 5 of the regulation sets out the principles from which all other obligations derive. Any processing must be justifiable in light of each of them:

• Lawfulness, fairness, and transparency: Processing must rely on one of the six legal bases in Article 6 (consent, contract, legal obligation, vital interests, public interest mission, legitimate interest).
• Purpose limitation: Data collected for invoicing cannot, without a new legal basis, be used for advertising profiling.
• Data minimization: Only strictly necessary data is collected. A full date of birth is rarely essential to verify adulthood.
• Accuracy: Incorrect data must be rectified or erased without delay.
• Storage limitation: Each category of data has a defined retention period, after which it is deleted or archived.
• Integrity and confidentiality: Encryption, access management, and logging protect against unauthorized access.

A seventh principle, accountability, shifts the burden of proof. Compliance is no longer sufficient; the data controller must be able to demonstrate it. The record of processing activities, impact assessments, and documentation of decisions thus become central elements in the event of an audit.

The new rights of European citizens

The GDPR strengthens existing rights (access, rectification, objection) and creates new ones. The data controller must respond to any request within one month. This deadline may be extended by two months for complex requests, provided the individual is informed. The exercise of these rights is, in principle, free of charge.

Right to erasure and data portability

The right to erasure, provided for in Article 17, allows individuals to obtain the deletion of their data when it is no longer necessary, consent is withdrawn, or the processing is unlawful. Exceptions exist: freedom of expression, legal retention obligations, or the establishment of legal claims. An accounting firm, for example, cannot erase documents subject to a legal retention period simply because a client requests it.

Portability, introduced in Article 20, is a true innovation. Individuals can retrieve the data they have provided in a structured, commonly used, and machine-readable format, such as CSV or JSON. They can also request its direct transmission to another service provider. This right applies only to processing based on consent or contract and automated processing.

Explicit and transparent consent

When processing relies on consent, it must be free, specific, informed, and unambiguous. Pre-ticked boxes, silence, or mere continued browsing do not constitute valid consent. Withdrawal must be as simple as giving consent: one click to accept implies an equivalent path to refuse.

The controller must also retain proof of consent, including the timestamp, the version of the information displayed, and the accepted purposes. For non-essential cookies, the CNIL has required since its 2020 guidelines that a "Reject All" button be as visible as the "Accept All" button.

Obligations and responsibilities for businesses

The regulation eliminates most prior declaration formalities. In return, it imposes documented and continuous compliance. Several key initiatives structure this approach.

The record of processing activities, provided for in Article 30, lists for each processing operation its purposes, the categories of data and data subjects, recipients, transfers outside the EU, and retention periods. A Data Protection Impact Assessment (DPIA) is mandatory for processing likely to result in a high risk, such as large-scale video surveillance or profiling. Relationships with subcontractors must also be governed by a contract compliant with Article 28.

The crucial role of the Data Protection Officer (DPO)

The appointment of a DPO is mandatory for public authorities and organizations whose core activities involve large-scale, regular, and systematic monitoring or the processing of sensitive data. The DPO may be internal or external, shared among several entities of a group. They must be registered with the CNIL.

Their missions include informing, advising, monitoring compliance, and cooperating with the authority. They benefit from protected independence: they receive no instructions regarding the performance of their duties and cannot be sanctioned for carrying them out. Their position must avoid conflicts of interest. An IT director who determines the means of processing is poorly placed to control them.

Managing data breaches and notifications

A data breach covers any destruction, loss, alteration, unauthorized disclosure, or access to data. The controller must notify the CNIL within 72 hours of becoming aware of it, unless the breach poses no risk to individuals. In cases of high risk, such as the leakage of banking or health data, the affected individuals must also be informed directly.

All breaches, whether notified or not, must be recorded in an internal register. A written procedure, tested through exercises, often makes the difference between a controlled notification and a crisis.

Sanctions and supervisory authorities: the role of the CNIL

In France, the Commission Nationale de l'Informatique et des Libertés (CNIL) is the supervisory authority. It advises, conducts on-site, online, or document-based inspections, and imposes sanctions through its restricted panel. It also publishes sector-specific frameworks and practical recommendations, useful for interpreting the gray areas of the text.

Article 83 provides for two caps on administrative fines:

The higher amount applies. Among the CNIL's landmark decisions is the €50 million fine imposed on Google in 2019 for lack of transparency and valid consent, followed by several sanctions related to cookies starting in 2020. A simplified procedure has existed since 2022 to handle less serious cases more quickly. For cross-border processing, the one-stop-shop mechanism designates a lead authority, which cooperates with its counterparts within the European Data Protection Board.

The lasting impact of the GDPR on the digital economy

The regulation first produced a global ripple effect. Several legislations draw inspiration from it, such as Brazil's LGPD or certain U.S. state laws. Companies operating across multiple continents often align their global policies with the European standard, which is simpler to manage than a patchwork of regimes.

It then reshaped international data transfers. The invalidation of the Privacy Shield by the CJEU's Schrems II ruling in 2020 required transfer impact assessments. The Data Privacy Framework was subsequently adopted in 2023 for flows to the United States. These developments have fueled demand for hosting and cloud services subject to European law.

Finally, the GDPR serves as the foundation for more recent texts: the Digital Markets Act, Digital Services Act, Data Act, and the Artificial Intelligence Regulation. Whenever an AI system is trained on personal data, the principles of minimization, legal basis, and transparency fully apply. Privacy by design, enshrined in Article 25, has thus become both a software architecture criterion and a legal requirement.

Compliance to be managed over time

The GDPR is not just about a cookie banner or a copied-and-pasted privacy policy. It is based on seven principles, translates into enforceable rights, and requires companies to provide permanent proof of compliance. The CNIL has the means to sanction breaches, with caps calculated on global turnover.

For an organization, the most effective approach remains methodical. It begins with mapping processing operations in an up-to-date record. Next come verifying the legal basis for each, reviewing contracts with subcontractors, and establishing a procedure for managing breaches and data subject requests.

Knowing what the GDPR is constitutes a first step. Implementing it daily, in every new project and tool, is what distinguishes superficial compliance from real data protection.