What is GDPR (General Data Protection Regulation)?
Definition
The GDPR (General Data Protection Regulation) is the European Union's Regulation (EU) 2016/679 on the protection of personal data, applicable since 25 May 2018. It defines the lawful bases for processing personal data, the rights of individuals and the obligations of controllers and processors. A company outside the EU can fall under it when it offers goods or services to people in the EU or monitors their behaviour.
Also known as: General Data Protection Regulation, Regulation (EU) 2016/679, EU GDPR, DSGVO, RGPD
When a non-EU business is in scope
The GDPR applies in two situations: the controller or processor has an establishment in the EU, or a company established elsewhere offers goods or services (paid or free) to people in the EU or monitors their behaviour there. The European Commission puts the test plainly: what matters is whether the company specifically targets the EU market. A website being reachable from Europe is not enough on its own.
Typical signs of targeting are shipping to EU countries, pricing in euros, content in an EU language aimed at users in that country, and ads served to EU audiences. A Turkish online shop selling to Germany, a SaaS product with customers in the Netherlands, or an ad setup that profiles visitors in France would all be in scope. The same data can then be subject to both the GDPR and Turkey's KVKK, and a company without an EU establishment usually has to appoint a representative in the EU.
This entry is general information, not legal advice.
The six lawful bases
Every processing activity has to rest on one of the following. The choice also shapes which rights the individual can exercise.
| Lawful basis | Typical web example |
|---|---|
| Consent | Marketing emails, advertising cookies |
| Contract | Name, address and payment details to fulfil an order |
| Legal obligation | Keeping invoices for tax law |
| Vital interests | Medical emergencies; rare on the web |
| Public task | Processing by public bodies within their mandate |
| Legitimate interests | Fraud prevention, security logs; requires a balancing test |
Consent under the GDPR must be freely given, specific, informed and unambiguous, expressed by a statement or a clear affirmative action. The stricter standard needed for special category data is covered under explicit consent.
Rights people can exercise
- Access to their data and a copy of it
- Rectification and erasure (the “right to be forgotten”)
- Restriction of processing, and objection, notably to direct marketing
- Data portability in a commonly used, machine-readable format
- Not being subject to significant decisions based solely on automated processing
Requests generally have to be answered within one month. Meeting them in a product means knowing where data lives and designing export and deletion features from the start rather than handling them by hand.
How it compares with KVKK
The two laws share a vocabulary: the definition of personal data, controller and processor roles, general principles and lawful bases are closely aligned. Since its 2024 amendment, KVKK's model for transfers abroad (adequacy decisions, standard contracts, binding corporate rules) is also much closer to the GDPR. The differences still matter in practice:
- Registration: KVKK has the public VERBİS registry; the GDPR instead requires internal records of processing activities.
- Fines: for the most serious infringements, the GDPR allows up to €20 million or 4% of worldwide annual turnover, whichever is higher.
- Breach notification: the GDPR requires notifying the supervisory authority within 72 hours where feasible; under KVKK the same window comes from a Board decision.
- Cookies: in the EU, cookie consent also stems from the separate ePrivacy Directive. The practical side is covered under cookie consent.
The European Commission's data protection guidance for businesses is a reliable plain-language starting point.