The General Data Protection Regulation: What It Says, What It Means

In recent days you’ve probably been bombarded with emails from businesses and organizations informing you of “significant updates in privacy policy” and asking for explicit permission to keep contacting you. The tsunami of emails with pleads to “stay in touch” or “to never let go” has led to a lot of frustration, but also humour, inspiring countless memes and even a Spotify playlist. Why were you spammed and why is everyone suddenly updating their terms of service?

All those emails you've received are due to GDPR – General Data Protection Regulation – the European Union's effort to better protect personal data, which went into effect on Friday. And although the GDPR was passed in the EU back in 2016, most of the companies put off this dreaded task and waited until the last moment to make their case for consent.

But GDPR is more than just an annoying inbox-clogger. The main goal of the regulation is to give individuals control over their personal information and impose stricter rules on companies both inside and outside of the EU that deal with EU businesses', residents', or citizens' data.

The 88-page law is definitely confusing and if you look around the internet everybody has different opinions on what it means, what it affects and how to comply with it. In fact, you probably didn't even need to receive the consent e-mails in the first place.

Politico's useful guide should help relieve some of the ambiguity by breaking down the principles encapsulated in the GDPR by "what it says" and "what it means." And if you're more into videos, go for this 3-minute YouTube explainer published by the Verge.