GDPR FAQ & Resources

What is the GDPR?

The General Data Protection Regulation (EU) 2016/680, or GDPR, is a European Union regulation governing the data privacy of individuals in the EU. The regulation came into full effect in May, 2018, superceding the Data Protection Directive 95/46/EC. The GDPR chiefly regulates the personal data processing practices of organizations established in EU member states. It also applies to certain organizations established entirely outside the EU, including in the United States, pursuant to Article 3 (2) of GDPR:

This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

How does the GDPR relate to Privacy Shield?

The Privacy Shield Framework is an arrangement for transatlantic data flows that enables U.S. businesses to comply with EU and Swiss data privacy requirements when processing personal data originating in Europe. Privacy Shield is a popular adequate transfer mechanism for U.S. companies receiving data from the EU and Switzerland, many of whom consider it an essential component of their data handling practices.

While Privacy Shield meets one of the key requirements of GDPR for companies transferring data to the U.S.—that they use an “adequate” data transfer mechanism for this purpose pursuant to Article 44—there are numerous other elements of GDPR that US companies should know about. Simply being compliant with the Privacy Shield does not mean that your company is fully compliant with GDPR. Many US companies will be complying with both in tandem.

While BBB EU Privacy Shield does not provide specific GDPR guidance or compliance services, we do receive many requests for GDPR information. We are providing this page as a compilation of resources for companies seeking information on a range of GDPR-related topics. The Data Protection Authorities in each EU Member State and their advisory body, the European Data Protection Board (formerly known as the Article 29 Working Party) routinely issue guidance about their interpretations of the GDPR. Various law firms, trade associations, and other entities in the EU and the U.S. also publish guidance and analysis of the new law.

The list of online resources below will be updated regularly as more information and guidance is released.

PLEASE NOTE: The information and guidance referenced on this page are those of the parties providing them, are general in nature and should not be considered to be legal or professional advice. For advice concerning the application of the GDPR to your specific business operations, you should consult with expert legal counsel familiar with your business.

This page was last updated on June 26, 2018.

The Regulation & Important Official Guidance

European Commission

Access Page

GDPR Full Text

2018 reform of EU data protection rules

Corrigendum – Update correcting and rectifying translation errors of the GDPR text.

European Data Protection Board (formerly Article 29 Working Party)

Guidelines:

Data Protection Impact Assessments

Data Protection Officer

Right to Data Portability

Identifying a Lead Supervisory Authority

Administrative Fines

Automated Individual Decision-Making and Profiling

Data Breach Notification

Transparency (rev.01 updated April 2018)

Consent (rev.01 updated April 2018)

Territorial Scope of the GDPR (including guidance on the requirement to designate a representative)

Opinions:

Data Processing At Work

Law Enforcement Directive

For a full list of guidelines and opinions of the Article 29 Working Party, including those published before 2016, refer to the IAPP’s Resource Center.