General Data Protection Regulation

GDPR Full Form in English, letter by letter

GDPR is the General Data Protection Regulation, the European Union law on privacy and personal data, in force since 25 May 2018.

GDPR Full Form in Indian Languages

Every 'we have updated our privacy policy' pop-up an Indian user dismisses traces back to one law, the GDPR, the General Data Protection Regulation of the European Union. The cards below show the name in six Indian languages.

What GDPR is and when it applies to you

The General Data Protection Regulation is EU Regulation 2016/679, adopted on 27 April 2016 and enforceable from 25 May 2018. It replaced the 1995 Data Protection Directive and put one set of privacy rules across all EU member states.

The part that catches Indian companies off guard is its reach. The regulation applies to any organisation anywhere in the world that offers goods or services to people in the EU, or monitors their behaviour, even with no office or staff in Europe. Selling a subscription to customers in Germany can be enough.

So an Indian software company, BPO or online seller with EU customers is covered. A firm serving only Indian customers, with no EU connection, is governed instead by India's own Digital Personal Data Protection Act, 2023.

The rights GDPR gives individuals

Consent must be freely given, specific and easy to withdraw, and pre-ticked boxes do not count. Consent is not the only route. The regulation lists other lawful bases, including a contract, a legal obligation and legitimate interests, which is why privacy notices now say which basis they rely on.

People can ask for a copy of their data, have errors corrected, have data erased (the 'right to be forgotten', shaped by the 2014 Google Spain ruling), move it to another provider (portability), and object to profiling or direct marketing. Organisations generally have one month to respond.

Breach notification carries a hard deadline. The controller must tell its national regulator within 72 hours of becoming aware, and tell the affected people too when the risk to them is high. Quietly patching the hole is not an option.

The key roles: controller, processor and DPO

GDPR separates the party that decides why and how data is used (the controller) from the party that handles it on the controller's behalf (the processor). Most Indian IT and outsourcing firms that serve European clients are processors, and they sign a data processing agreement that spells out security, sub-contracting and deletion duties.

A Data Protection Officer must be appointed where an organisation monitors people on a large scale or processes sensitive data at scale, such as health records. The DPO advises the company and is the contact point for the regulator, and cannot be penalised for giving honest advice.

Personal data means anything that identifies a person directly or indirectly: a name, an email address, an IP address, a phone number, a photo. 'Special category' data, such as health, religion or biometrics, needs stronger justification.

Penalties, and how enforcement looks in practice

There are two tiers of fines. The lower tier reaches up to €10 million or 2% of worldwide annual turnover, whichever is higher, for failures such as weak security or missing records. The upper tier reaches up to €20 million or 4% of worldwide turnover for breaching core principles or individual rights.

Enforcement is not theoretical. Ireland's Data Protection Commission fined Meta €1.2 billion in 2023 over EU-to-US data transfers and WhatsApp €225 million in 2021, and Luxembourg's regulator fined Amazon €746 million in 2021.

For smaller firms, regulators more often use orders and warnings than fines: stop this processing, fix your records, train your staff. In daily compliance work, the problems that get reported are usually missed 72-hour deadlines and missing records of processing rather than anything dramatic.

What GDPR changed for Indian businesses and users

IT and outsourcing exporters had to rewrite client contracts, appoint data protection officers where needed, and standardise consent wording across products. Global clients pass their GDPR obligations down to Indian vendors as standard terms, so compliance became a sales requirement rather than a legal extra.

It also created a profession: privacy counsel, DPOs and consultants who map data flows for a living. India's DPDP Act followed a similar shape with consent and a list of 'legitimate uses', and companies serving both markets tend to build to whichever regime is stricter.

For ordinary users the effects are visible: the wave of policy-update emails in May 2018, cookie banners on almost every site, and the ability to ask a company for your data or for its deletion.

Even routine records count as personal data under the regulation: a name and email address, an IP address, a photo, or the KYC documents and OTP phone numbers an onboarding process collects. An Indian service provider handling that data for EU customers should know where it is stored, who can see it and when it will be deleted.

GDPR matters beyond Europe because it follows the user, not the company's address. If you run a site or service that treats someone as an EU user, you need a lawful basis, a way to honour their rights and a plan for the 72-hour clock. If you are only a user, it is the reason you can ask a company what it knows about you.

GDPR Full Form: Common Questions