General Data Protection Regulation (GDPR)

What it is

The General Data Protection Regulation (Regulation (EU) 2016/679) is the EU's horizontal personal-data protection law, adopted in 2016 and applicable from 25 May 2018. It applies to any organisation processing personal data of individuals in the EU, irrespective of where the organisation itself is established.

Key principles

• Lawfulness, fairness, transparency.
• Purpose limitation. Data collected for one purpose cannot be repurposed without a fresh legal basis.
• Data minimisation. Collect only what is needed.
• Accuracy. Keep data accurate and up to date.
• Storage limitation. Retain only as long as necessary.
• Integrity and confidentiality. Appropriate security.
• Accountability. The controller must be able to demonstrate compliance, not just claim it.

Article 22 — automated decision-making

Article 22 grants individuals the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects. This is the article most directly relevant to financial-defence AI: consequential decisions about an individual must have a human in the loop.

Enforcement

Maximum administrative fines reach EUR 20 million or 4% of global annual turnover, whichever is higher. National data-protection authorities (e.g. CNIL in France, the Datenschutzbehörde in Austria) investigate and enforce, coordinated by the European Data Protection Board.