The GDPR requires organizations to protect personal data in all its forms.
It also changes the rules of consent and strengthens people’s privacy rights.
Any organization (companies, charities, even micro-enterprises) that handles the personal information of EU citizens or residents is subject to the GDPR.
That includes organizations not in the EU but that offer goods or services to people there.
If a company collects, stores, or uses the data of people in the EU, then the GDPR applies to them.
The GDPR Article 5 principles relate to lawfulness, fairness, and transparency.
This means someones data can only be used if it is allowed under one of six legal justifications, it must be fair to the data subject, and it must be based on transparent and unambiguous communication with the data subject.
GDPR Article 6 covers six lawful bases to allow processing, collecting, storing and using of someones data.
Consent must be freely given, specific, informed and unambiguous.
Requests for consent must be clearly distinguishable from the other matters and presented in clear and plain language.
Data subjects can withdraw previously given consent whenever they want, and you have to honor their decision. Companies cannot simply change the legal basis of the processing to one of the other justifications.
Children under 13 can only give consent with permission from their parent.
They need to keep documentary evidence of consent.
To have a legitimate interest to process someones data.
The ePrivacy Directive, specifically Article 13, presents organizations with another way to use someones data for marketing purposes that stems from the contractual basis of the GDPR.
An organization, may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, according to Article 13, part 2.
Essentially this means that an organization can lawfully send you marketing emails about the service they provide you as long as they inform you that you can opt-out at any time.