GDPR in a Nutshell

Accountability under GDPR means a company must be able to demonstrate and document why it keeps personal data for as long as it does - "we've always done it this way" isn't a defence.

GDPR doesn't set a fixed retention period - instead, personal data can only be kept for as long as it's actually needed for the purpose it was collected for.

Every GDPR obligation traces back to seven core principles: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

Non-EU companies that offer goods or services to, or monitor the behaviour of, people in the EU must comply with GDPR - regardless of where the company itself is based.

The GDPR is an EU regulation that safeguards privacy rights while ensuring organizations process personal data lawfully and fairly. It sets clear principles for data handling, helping businesses build trust and demonstrate accountability, without imposing disproportionate burdens.