GDPR
General Data Protection Regulation
GDPR (General Data Protection Regulation, Regulation (EU) 2016/679) is the EU and EEA rule set for processing personal data of residents, and it also applies to companies outside Europe.
What is GDPR (General Data Protection Regulation)?
The GDPR took effect on 25 May 2018. It applies to any organization that processes personal data of EU and EEA residents if it offers them goods or services or monitors their behavior (Article 3). Company registration in Curaçao or another jurisdiction makes no difference if the audience is European.
## How it works
Personal data is any information that can identify a person: email, phone number, IP address, cookie identifiers, device IDs, betting or deposit history. Processing requires a lawful basis under Article 6, such as consent, performance of a contract, legal obligation, legitimate interest, or others. Users have the right to access, rectify, erase, restrict processing, port their data, and object to processing.
## Where it shows up in high-risk verticals
Gambling and betting: player profiles, betting and deposit history, data collected for KYC and AML. AML retention obligations can conflict with the right to erasure, so a documented data retention policy is needed. Crypto: blockchain records cannot be changed, which complicates erasure, and wallet addresses are often treated as personal data. Nutra: health data is a special category (Article 9) and requires explicit consent or another exception. Dating: data on sexual orientation and intimate preferences is also a special category. Fintech and payments: transfers, card data, and customer identification must be aligned with PSD2 and PCI DSS rules.
## Common mistakes
Assuming consent is required for everything: strictly necessary cookies do not require consent, while analytics and marketing usually do. Sharing data with partners and trackers without a data processing agreement (DPA). Transferring data to third countries without a valid transfer mechanism. Collecting leads through a form without clear information about the purposes of processing.
## Fines
Article 83 provides for fines of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious violations. Actual enforcement decisions by supervisory authorities depend on the specific circumstances of each case.
FAQ
Does the GDPR apply to a company outside the EU?
Yes, if the company offers goods or services to EU residents or monitors their behavior online. This follows directly from the territorial scope in Article 3.
Do all websites need a cookie banner?
A banner and consent are needed for cookies that are not strictly necessary, including analytics and marketing trackers. Exact requirements also depend on national law, so check them with a lawyer.
What if a user asks for their data to be deleted but AML requires it to be kept?
The right to erasure is not absolute: a legal retention obligation is a valid ground for refusing deletion. Restrict processing, keep only the necessary data, and document the basis in your policy.