GDPR (General Data Protection Regulation)
An EU regulation effective May 2018, applying directly and uniformly across member states (no national transposition needed) to any organization processing EU residents’ personal data, regardless of where that organization is based. Beyond the historical lineage covered in Fair Information Practices (the EU’s 1995 Directive, the U.S.–EU safe harbor mechanism GDPR’s arrival superseded), GDPR’s consent, rights, and default-setting requirements are what actually shape an interface.
GDPR’s consent, rights, and default-setting requirements are what actually shape an interface.
Ground every processing activity in a lawful basis, and don’t over-ask for consent
GDPR permits processing only under one of six lawful bases: consent, contract necessity, legal obligation, vital interests, public task, or legitimate interests. Consent is only one of these — if a contract or a legal obligation already justifies collecting something, asking for consent on top of it is both unnecessary and, per the “freely given” requirement below, potentially invalid, since a consent request implies the customer has a genuine choice to refuse. A consent interface (a cookie banner, an onboarding toggle) should ask only about the processing that genuinely rests on consent as its basis, and give plain notice — not a consent request — for everything else.
Design consent as active, specific, and reversible
Article 7 sets four conditions a consent mechanism has to meet:
- Freely given — refusing can’t cost the customer access to the service (no “consent walls”).
- Specific — one toggle per purpose, not one box covering marketing, analytics, and third-party sharing at once.
- Informed — what’s collected, why, who receives it, and for how long, stated before the customer decides, not after.
- Unambiguous — an active opt-in (a click, an unchecked-by-default box someone deliberately checks), never inferred from scrolling or continued use.
Withdrawing consent has to be exactly as easy as giving it: if opting in was one click, opting out can’t be buried three settings screens deep or require contacting support.
Withdrawing consent has to be exactly as easy as giving it: if opting in was one click, opting out can’t be buried three settings screens deep or require contacting support.
The regulation’s own text names the specific mechanism that satisfies “unambiguous”: “ticking a box when visiting an internet website” is its own worked example of a clear affirmative act, while silence, a pre-ticked box, or mere continued use of the site explicitly do not count as consent at all — not just weak consent. The request itself is also constrained: when consent is asked for electronically, the request “must be clear, concise and not unnecessarily disruptive to the use of the service” — a standard that applies to the interruption a consent prompt causes, not only to what the prompt’s controls do.
Surface the full set of data-subject rights, not just erasure
Beyond the right to erasure and data portability already covered in Fair Information Practices, GDPR grants:
- Access — a full account of what’s held, why, its source, and who it’s shared with (typically an account-page “your data” export).
- Rectification — editable fields, plus a way to flag an inferred attribute as wrong.
- Restriction — pause processing during a dispute without deleting the data outright.
- Objection — an always-available opt-out for legitimate-interest-based marketing.
- A right against solely-automated decisions — where a decision (credit, hiring, pricing) is made by an algorithm alone, the right to know that, request human review, and contest the outcome.
Default to the most private setting (Article 25)
Privacy by Design and by Default requires privacy to be built into a product from the start, not patched on after launch, and requires that default settings already sit at the most privacy-protective option — non-essential toggles off, non-essential cookies not loaded until consent is given, profile visibility private until the customer chooses otherwise. The customer should have to opt in to less privacy, never opt out of more.
The customer should have to opt in to less privacy, never opt out of more.
Notify quickly after a breach
A breach must be reported to the relevant supervisory authority within 72 hours of discovery, unless it’s genuinely unlikely to risk anyone’s rights or freedoms. Affected individuals must be told directly, “without undue delay,” whenever the breach poses a high risk to them — unless the exposed data was encrypted or pseudonymized well enough that whoever has it can’t actually read it, which is itself a design reason to encrypt sensitive data at rest.
Know when a DPO or impact assessment is required
Large-scale systematic monitoring (behavioral tracking, broad analytics), large-scale processing of sensitive categories (health, biometric, criminal-record data), or public-authority status each trigger a requirement to name a Data Protection Officer and publish their contact details, and to complete a Data Protection Impact Assessment before launching the processing — relevant to any product built around recommendation engines, ad targeting, or biometric login.
Related Concepts
Patterns
Principles
Standards
Sources
General Data Protection Regulation (Wikipedia) (CC BY-SA) is this page’s source for the six lawful bases, the four consent conditions (freely given, specific, informed, unambiguous), the data-subject-rights list beyond erasure, the Article 25 default-setting requirement, and the 72-hour breach-notification deadline above.
Regulation (EU) 2016/679 — General Data Protection Regulation (EUR-Lex official text) is the official regulation text itself, cited directly for Recital 32’s exact consent-mechanism wording (the “ticking a box” example, the pre-ticked-box exclusion, and the consent-request disruptiveness standard) in the Design consent section above.