General Data Protection Regulation (Wikipedia)
Wikipedia’s article on the GDPR, the EU regulation effective May 2018 that replaced the 1995 Data Protection Directive already summarized in Fair Information Practices, with new, deeper design-facing material on lawful bases, consent-UI requirements, the full set of data-subject rights, Privacy by Design/Default, breach notification, and DPO/DPIA triggers.
License: CC BY-SA 4.0 — https://creativecommons.org/licenses/by-sa/4.0/
Key points
- Processing needs one of six lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests); consent should only be requested when it’s actually the basis relied on.
- Valid consent must be freely given, specific (one purpose per toggle), informed (disclosed before the choice, not after), and unambiguous (an active opt-in, never inferred); withdrawing must be no harder than giving it.
- Data-subject rights beyond erasure/portability include access, rectification, restriction of processing, objection, and safeguards around solely-automated decision-making.
- Article 25 (Privacy by Design and by Default) requires privacy-protective settings as the default, not an opt-out a customer has to find.
- Breaches must reach the supervisory authority within 72 hours, and affected individuals “without undue delay” when the risk to them is high; a Data Protection Officer and a Data Protection Impact Assessment are required for large-scale monitoring or sensitive-category processing.