General Data Protection Regulation

The General Data Protection Regulation (GDPR, EU 2016/679) is European legislation governing personal data processing. Effective 25 May 2018, it harmonizes privacy protections across all EU member states and establishes consistent rules for how organizations collect, store, and manage individuals' information. The regulation applies to any entity processing personal data of EU residents, regardless of location.

GDPR establishes foundational principles requiring data to be processed lawfully, fairly and in a transparent manner with accountability measures throughout. It grants data subjects extensive rights including access to their information, correction of inaccuracies, and deletion requests. The European Data Protection Board coordinates enforcement across member states, with national supervisory authorities ensuring compliance through investigations and significant administrative penalties.

For heritage and archival institutions, GDPR introduces important considerations around digitization, access restrictions, and historical research exemptions, balancing preservation goals with individual privacy protections and transparency obligations in custodial practices.