GDPR, explained
The General Data Protection Regulation is an EU data-protection framework governing covered processing of personal information.
- The field
- Legal
- Reading time
- 1 minute
- In this entry
- Meaning · relevance · limits
The meaning
The General Data Protection Regulation is an EU data-protection framework governing covered processing of personal information.
Why it matters
Hosting decisions can involve controller and processor roles, security measures, retention and international transfers. A server address alone is not a compliance assessment.
The boundary
Determine the actual processing and parties involved before claiming that a service complies.
Trace a customer record through the stack
An online store keeps customer names in a database, copies them to a backup and sends transactional email through another supplier. Document each processing purpose, access boundary and recipient. A selected data-centre country is only one part of the assessment: territorial scope, lawful processing and any transfer mechanism also matter.
- Assess Article 3 scope from establishment, offering goods or services, or monitoring behaviour; citizenship alone is not the test.
- Include backups, support exports and third-party integrations in the data map.