What is GDPR?

Compliance with GDPR is essential when handling, processing, and storing the personal data of people in the EU. 

Implemented in 2016, GDPR requires a business to protect the personal data of EU citizens for transactions that occur within EU member states. It also regulates how data can be exported outside the EU. 

Unlike SOC 2 compliance, which is voluntary, GDPR compliance is mandatory and can result in severe fines and reputational damage in the case of violation. In turn, businesses have developed new data processing practices and built corporate governance structures to meet the requirements of GDPR. 

For example, Sendbird redesigned its dashboard to clearly display the user’s rights and authority when using our in-app messaging platform. This allows the user full transparency of how data is used at every step. Additionally, we released new versions of our Data Export and Data Migration tools that meet GDPR requirements and clarify if a user’s actions are at odds with GDPR compliance.

Key aspects of GDPR compliance

• Personal data: GDPR defines personal data as any information that relates to an identifiable person. This can include user profiles, names, email addresses, IP addresses, phone numbers, or any other data that can directly or indirectly identify an individual.

• Lawful basis for processing: Under GDPR, personal data must be processed on a lawful basis. This can include obtaining user consent, complying with legal requirements, meeting contractual obligations, and more. Data cannot be processed in a way that overrides the rights and freedoms of individuals.

• Data subject rights: Individuals gain certain rights under GDPR, including the right to access their data, erase data, restrict processing, rectify inaccuracies, and raise objections. Quality in-app messaging platforms should provide developers with the mechanisms that enable individuals to exercise these rights within the user interface.

• Privacy by design and default: GDPR promotes the idea that privacy considerations be incorporated into designing and developing user-facing products, such as messaging apps. This includes implementing technical and organizational measures to protect user data and minimize data collection to what is needed for a specific purpose.

• Notice of data breaches: GDPR mandates that organizations must notify individuals and relevant supervisory authorities in the event of a personal data breach, so long as there’s a risk to individual rights and freedoms.

• Data transfers: GDPR restricts how personal data can be transferred outside the EU. Safeguards and other approved mechanisms must be implemented when data is being transferred to countries lacking adequate data protection.

Compliance with GDPR requires a business to implement a range of technical and operational measures to handle, protect, and record activities around personal data. The best companies review their data handling practices, implement privacy policies and consent mechanisms, and maintain processes that handle data in a way that respects individuals' rights.