What is GDPR?
The EU's data-protection regulation — establishes consent, purpose-limitation, residency, breach-notification, and the data-subject rights regime.
Also known as
GDPR — explained.
GDPR (General Data Protection Regulation, Regulation (EU) 2016/679) is the European Union's data-protection regulation, in force since 25 May 2018. It governs the processing of personal data of EU residents regardless of where the processor is located, with extra-territorial reach. The UK retains a near-identical regime as the 'UK GDPR' post-Brexit. The core principles: lawful basis for processing (consent, contract, legal obligation, vital interest, public task, or legitimate interest); purpose limitation (use data only for the stated purpose); data minimisation (collect no more than needed); accuracy; storage limitation (retain no longer than needed); integrity / confidentiality (security); accountability (be able to demonstrate compliance). The data-subject rights regime gives EU residents the right to access, rectify, delete (right to erasure), restrict processing, object, and data portability. Operators must respond to data-subject requests within one month. Breach notification to the supervisory authority is required within 72 hours of awareness. Fines are up to €20m or 4% of global annual revenue. The Schrems II ruling (2020) tightened residency by ruling that personal data transfers to the US under Privacy Shield are unlawful unless additional safeguards apply, which drove most EU controllers toward EU-only cloud regions or on-prem.
Why operators care about gdpr.
For any software touching EU resident data, GDPR is the baseline compliance regime — not an add-on. Practically: every Zeour deployment ships GDPR-ready primitives (consent, purpose, retention, subject-rights workflows, breach logging) and the admin includes a GDPR data-subject delete tool out of the box.
Zeour solutions that operate on this layer.
Verticals where gdpr is operationally critical.
Case studies where gdpr is deployed.
Blog posts that go deeper on gdpr.
Adjacent definitions to read next.
PDPL
Compliance & DataPersonal Data Protection Law — the data-protection regime in Saudi Arabia (and equivalents in the UAE and several Gulf states).
Data Residency
Sovereign DeploymentA requirement that personal or regulated data is stored, processed, and backed up within a defined jurisdiction — usually a country or a treaty bloc.
Sovereign Deployment
Sovereign DeploymentSoftware that runs entirely inside the operator's perimeter — their hardware, their network, their backups, their keys — with no third-party dependency for continued operation.
HIPAA
Compliance & DataThe US healthcare-data-protection law governing Protected Health Information (PHI) — covers privacy, security, breach notification, and business-associate agreements.
PCI DSS
Compliance & DataThe Payment Card Industry Data Security Standard — the security baseline that any system handling card data must meet.
CCPA / CPRA
Compliance & DataCalifornia's data-protection law — and the CPRA amendment in force since 2023 — establishing data-subject rights for California residents.
Cyber Essentials
Compliance & DataThe UK NCSC's baseline cybersecurity certification — a five-control posture (firewalls, secure config, access control, malware, patches) increasingly required for UK government contracts.
Data Subject Access Request (DSAR)
Compliance & DataThe data-subject's right to request a copy of all personal data an operator holds about them, plus deletion, correction and processing-restriction rights — under GDPR, PDPL and equivalent laws.
Talk to a Zeour engineer.
A 30-minute scoping call to walk your operational profile against where gdpr actually sits in your stack, then a fixed-fee Discovery price by the end of the call.