What is the GDPR?
The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, has applied directly in all EU member states since 25 May 2018, and through the EEA Agreement also in Norway, Iceland and Liechtenstein. It governs how companies and public bodies may process personal data, meaning any information relating to an identified or identifiable person.
The principles in Article 5:
- lawfulness, fairness and transparency
- purpose limitation and data minimisation
- accuracy and storage limitation
- integrity and confidentiality
- accountability: the controller must be able to demonstrate that these principles are met
Data subjects have, among others, the right of access, rectification, erasure, restriction of processing, data portability and objection. A company that uses service providers usually needs a data processing agreement (Art. 28). Infringements can lead to fines of up to EUR 20 million or 4 % of worldwide annual turnover.
This entry is not legal advice.
The GDPR at Openbase.one
Whether a processing activity is lawful is your decision as the controller. Openbase.one gives you facts to work with: platform data is hosted in Frankfurt, workspaces are separated at database level, and when an app is built its records are classified (internal, personal, sensitive, tax). An exportable audit log shows who changed what. Data is exportable, deletion is available on request, and so is a DPA.
Describe your first app and watch it go live, checked.
Start for free