GDPR
The General Data Protection Regulation (GDPR) is a data privacy regulation formally enacted by the European Union in 2018, applicable to all organizations and enterprises that process personal data of EU residents regardless of their location. The regulation establishes fundamental principles for the collection, storage, processing, and transfer of personal data, grants data subjects rights including access, rectification, and erasure, and prescribes strict penalty mechanisms for violations. It is one of the most widely influential data protection regulations in the world.
Core Facts
The Privacy by Design concept was proposed as early as the 1990s by Canadian Information and Privacy Commissioner Ann Cavoukian and encompasses seven core principles.
GDPR规定违规企业可面临高达全球年营收4%或2000万欧元（取较高者）的罚款
The Privacy by Design principle has been incorporated into Article 25 of the GDPR, becoming a legally binding compliance requirement.
Timeline (last 90 days)
In heavily regulated industries such as finance, healthcare and law, cross-border data transfer and third-party processing are often strictly restricted by the Personal Information Protection Law, GDPR or industry regulatory rules.
Compliance frameworks such as SOX, GDPR, and Multi-Level Protection Scheme increasingly emphasize attributability, and agents that share credentials or borrow human accounts will constitute audit deficiencies.
Cross-organizational data sharing requires fine-grained permission control, audit trails, and compliance frameworks, with the sharing party retaining the right to withdraw and restrict use, which is consistent with the spirit of data protection regulations such as the EU's GDPR.
The EU GDPR and China's Personal Information Protection Law both impose requirements on the granularity of notification, which is the legal backdrop for the argument that a brief explanation should be added next to the button.
When evaluating third-party AI code services, enterprises typically look at: whether the provider offers a commitment not to retain data or use it for training, whether it supports private deployment or a dedicated cloud, whether transmission and storage are encrypted, whether access logs can be audited, and whether it complies with the regulatory requirements of the relevant industry and region (such as the Data Security Law, GDPR, etc.).
The EU GDPR and ePrivacy Directive require prior consent (opt-in) for marketing email and guarantee data subjects' rights of access and erasure.
GDPR sets a 72-hour deadline for data breach notification, and all 50 U.S. states have breach notification laws.
Compliance requirements for medical AI involve data privacy (such as HIPAA and GDPR), model interpretability (such as Grad-CAM heatmaps) and clinical validation processes.
Article 22 of the EU's General Data Protection Regulation (GDPR) grants individuals the right to an explanation of automated decisions, which is especially sensitive in scenarios such as credit and insurance pricing.
The GDPR's purpose limitation principle requires that the purposes for collecting personal data must be specific, explicit, and legitimate, and that subsequent processing must not conflict with the initial purpose.
40 more timeline events
All Facts (20)
The Privacy by Design concept was proposed as early as the 1990s by Canadian Information and Privacy Commissioner Ann Cavoukian and encompasses seven core principles.
90%VerifiedGDPR规定违规企业可面临高达全球年营收4%或2000万欧元（取较高者）的罚款
90%VerifiedThe Privacy by Design principle has been incorporated into Article 25 of the GDPR, becoming a legally binding compliance requirement.
85%VerifiedGDPR是欧盟于2018年实施的数据隐私法规，违规罚款最高可达全球年营业额的4%
85%VerifiedIn 2023, Meta was fined €1.2 billion for transferring European user data to the United States in violation of GDPR.
85%VerifiedGDPR officially took effect in 2018, with maximum fines for violations reaching 4% of a company's global annual turnover; CCPA took effect in California in 2020.
80%Verified欧盟《通用数据保护条例》（GDPR）于2018年生效，确立了数据最小化、目的限制、知情同意等核心原则
80%Verified中国已实施《数据安全法》和《个人信息保护法》，对企业数据出境提出严格要求
80%VerifiedThe EU's GDPR, the US's HIPAA, and China's Data Security Law all impose strict restrictions on the cross-border transfer and third-party processing of sensitive data.
80%VerifiedData Residency refers to the requirement that data must be stored within a specific geographic region or jurisdictional boundary, and is a core concept in enterprise data compliance systems
80%VerifiedUnder GDPR, data controllers must report personal data breaches to supervisory authorities within 72 hours of discovery.
75%VerifiedThe EU implemented the General Data Protection Regulation (GDPR) in 2018, establishing a legal framework for data localization.
75%VerifiedGDPR is a data privacy regulation implemented by the EU in 2018 that requires data processors to prove the lawfulness of data collection, provide clear opt-out mechanisms, and respond to data deletion requests.
75%VerifiedArticle 17 of the GDPR grants users the 'Right to Erasure,' requiring companies to delete users' personal data upon request.
75%Verified欧盟GDPR立法强制要求数据可携带权（Right to Data Portability）
75%VerifiedSince the EU's GDPR was implemented in 2018, it has cumulatively issued fines exceeding 4 billion euros to tech giants such as Google and Meta
75%VerifiedThe rise of sovereign AI demand is closely related to localization legislation such as the EU's GDPR, China's Data Security Law, and India's Personal Data Protection Bill.
75%VerifiedThe EU has previously regulated the behavior of tech giants through the General Data Protection Regulation (GDPR) and the Digital Services Act (DSA).
70%VerifiedArticle 28 of the GDPR requires data controllers to sign a Data Processing Agreement (DPA) with data processors, clearly specifying the purpose of processing, retention periods, and a list of sub-processors
70%VerifiedArticle 44 of the GDPR stipulates that the transfer of personal data to third countries requires an adequacy decision or the signing of standard contractual clauses.
70%