Facts and myths about Rodo

GDPR, which stands for General Data Protection Regulation, is a set of rules introduced in the European Union in May 2018, aimed at strengthening and standardizing the protection of personal data of all individuals in the EU. Below are a few popular facts and myths associated with GDPR:

Facts about GDPR:

1. Applies to all companies and organizations in the EU: GDPR applies to all companies and organizations operating in the EU that process personal data, regardless of their size. This also applies to companies based outside the EU if they offer goods or services to individuals in the EU or monitor their behavior.
2. Rights of data subjects: GDPR strengthens the rights of individuals, giving them greater control over their personal data. These individuals have the right to access their data, correct it, delete it ("right to be forgotten"), restrict processing, and also the right to data portability.
3. Information obligation: Organizations must inform individuals whose data they process in a clear and understandable manner.
4. Principle of accountability: Organizations are responsible for complying with the GDPR principles and must be able to demonstrate compliance with its requirements, which means implementing appropriate data protection procedures and policies.

Myths about GDPR:

1. Only applies to large companies: This is a myth, as GDPR applies to any organization that processes personal data, regardless of its size. This means that small and medium-sized enterprises must also comply with these regulations.
2. Every data breach leads to huge fines: Although GDPR provides for high fines for breaches (up to 20 million euros or up to 4% of global annual turnover), these fines are imposed proportionately to the nature of the breach, its scale, and circumstances. Not every breach results in maximum penalties.
3. Consent is required for data processing in every case: Consent is not the only legal basis for data processing. GDPR also lists other legal bases, such as performance of a contract, legal obligation, protection of vital interests of the individual, and the legitimate interests pursued by the data controller.
4. GDPR prohibits the processing of personal data: This is also a myth. GDPR regulates the processing of data, but does not prohibit it. The goal is to ensure that data is processed transparently, securely, and only to the extent necessary to achieve specific, legal purposes.

GDPR has introduced many changes in the way organizations must approach personal data, but at the same time offers clear guidelines on how to process this data without violating the privacy of individuals.