The General Data Protection Regulation (GDPR) is the European Union's comprehensive data privacy and protection law, in effect since 2018. It governs how organizations collect, use, store, and protect the personal data of individuals in the EU, and grants those individuals strong, enforceable rights over their data. GDPR is notable for its broad extraterritorial reach and its severe penalties — up to €20 million or 4% of global annual revenue, whichever is greater. It has become the global reference point for modern privacy law.

Yes, frequently. GDPR applies to any organization, regardless of location, that offers goods or services to people in the EU or monitors their behavior. So a U.S. company with EU customers, EU website visitors it tracks, or EU employees generally must comply. Many U.S. businesses are surprised to learn they're in scope. Propelex helps you determine your GDPR exposure and, if you're in scope, build a compliant program — without over-applying it where it doesn't reach.

GDPR grants data subjects a robust set of rights, including the right to be informed about how their data is used; the right of access (to obtain a copy of their data); the right to rectification (correct inaccurate data); the right to erasure (the 'right to be forgotten'); the right to restrict or object to processing; and the right to data portability. Organizations must have processes to honor these requests, usually within one month. Propelex helps you build the data subject request workflows and the data mapping that makes honoring them possible.

A Data Protection Impact Assessment (DPIA) is a structured process to identify and minimize the privacy risks of a project or processing activity. GDPR requires a DPIA whenever processing is likely to result in a high risk to individuals — for example, large-scale processing of sensitive data, systematic monitoring, or new technologies. The DPIA documents the processing, assesses necessity and proportionality, identifies risks, and defines mitigations. Propelex conducts DPIAs and builds a repeatable DPIA process for your high-risk activities.

GDPR has a two-tier penalty structure. Less severe infringements can draw fines up to €10 million or 2% of global annual revenue; the most serious infringements (such as violating core principles or data subject rights) can draw up to €20 million or 4% of global annual revenue — whichever is greater in each case. Regulators have issued numerous multi-million-euro fines. Beyond fines, non-compliance brings reputational damage and potential bans on processing. Propelex helps you avoid these outcomes with demonstrable compliance.

Both protect personal data, but they differ in scope and approach. GDPR is broader and stricter: it applies to all processing of EU residents' personal data, requires a lawful basis before processing, and grants extensive rights. CCPA (and its successor CPRA) focuses on California residents and emphasizes transparency, the right to know, the right to delete, and the right to opt out of the sale or sharing of personal information. A program built for GDPR generally covers much of CCPA, but each has specific requirements. Propelex helps you comply with both efficiently.