GDPR

The General Data Protection Regulation applies directly in every EU and EEA member state. Its territorial scope (Art. 3) reaches organisations established in the EU and those outside it that offer goods or services to people in the EU or monitor their behaviour, which is why it affects companies worldwide.

The regulation rests on seven principles (Art. 5): lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. It requires a lawful basis for each processing activity (Art. 6), grants rights such as access, rectification, erasure, portability and objection, and imposes accountability tools: records of processing, DPIAs, privacy by design, data protection officers in certain cases and breach notification. Independent supervisory authorities enforce it, with fines that can reach a percentage of worldwide annual turnover.

The GDPR inspired many laws, including Brazil's LGPD, and interacts with the EU AI Act whenever an AI system processes personal data. Its concepts form the core of the DPAI exam.