European Data Protection Law and Regulation
The skeleton of the GDPR
Learn the structure in order. Article 4 definitions: personal data (any information relating to an identified or identifiable natural person), processing, controller (determines purposes and means), processor, pseudonymisation. Article 5 principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. Article 6 gives six lawful bases - consent, contract, legal obligation, vital interests, public task, legitimate interests - with legitimate interests unavailable to public authorities acting in the public task. Article 9 lists special categories (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health, sex life or sexual orientation) plus criminal data in Article 10, and the conditions that lift the prohibition. Articles 12–22 set transparency and data subject rights; Articles 24–43 build accountability through records, security, breach notification, impact assessments, DPOs, codes and certification. Article 83 fines reach EUR 20 million or 4% of worldwide annual turnover.
Traps
Special category data needs a lawful basis under Article 6 and a separate condition under Article 9. Article 3(2) applies only where an entity targets people in the EU by offering goods or services or monitoring behaviour - mere accessibility of a website is not targeting. GDPR consent (freely given, specific, informed, unambiguous) is not identical to ePrivacy rules for cookies and marketing. A processor that goes beyond instructions becomes a controller for that processing.
Worked example
A US retailer ships to EU customers in euros, advertises in EU languages and runs retargeting ads. It falls under Article 3(2) and needs an Article 27 representative even without an EU establishment. A globally readable website with no EU-directed activity would not.