Digital Lexicon Hub

The EU regulation that sets rules for processing the personal data of people in the EU, including lawful bases, individual rights and fines.

GDPR applies to any company that offers goods or services to people in the EU or monitors their behavior, so it shapes analytics, advertising, CRM and AI projects, and violations can bring fines, processing bans and lost trust.

Before launching a lead form, a company records legitimate interest or consent as its lawful basis, explains the use in its privacy notice, signs a data processing agreement with its email platform and sets a 24-month deletion rule for inactive contacts.

GDPR compliance is not a one-time certification; it rests on documented decisions that regulators may judge differently. Cookies and tracking are also governed by ePrivacy rules, and pseudonymized data remains personal data under GDPR.

Regulation (EU) 2016/679 applies from 25 May 2018. Article 5 sets principles such as purpose limitation, data minimization and accountability, and Article 6 lists six lawful bases, including consent, contract and legitimate interests. Controllers and processors carry separate duties, data subjects have rights such as access, erasure and objection, and Article 83 allows fines up to €20 million or 4% of worldwide annual turnover, whichever is higher. Consent Mode and First-Party Data practices build on these rules.