GDPR: The new era of data protection in Europe has begun. Find out what has changed

From this Friday, 25 May, the European Union has some of the strictest rules anywhere on the protection of citizens’ data. It is the date on which the new General Data Protection Regulation (GDPR) comes into force, a regulation many companies have been preparing for over years and others have not even started to look at. If you are more or less up to date on the subject, you will know this backwards by now: fines can reach 20 million euros or 4% of a company’s annual turnover. You cannot be too careful.

What changes from now on? It depends. If you represent an organisation, you will have to be able to prove that you comply with the regulation should the supervisory authority, the National Data Protection Commission (CNPD), approach you for that purpose. As a European citizen, on the other hand, you now have more rights as the subject of personal data. To begin with, your data can only be collected with your consent — and even that authorisation can be withdrawn. In theory, there is also more transparency about how companies handle your information.