Definition
GDPR
The General Data Protection Regulation is the European Union's comprehensive data-protection law, in force since 2018. It governs how organizations collect, process, and store the personal data of people in the EU, granting individuals rights over their data — access, correction, deletion, portability — and imposing strict obligations on data handlers, backed by fines of up to 4% of global annual revenue.
Key takeaways
- GDPR is the EU's data-protection law (since 2018) governing how organizations collect, process, and store personal data of people in the EU.
- It applies extraterritorially — any company handling EU residents' personal data must comply, wherever it is based.
- It grants individuals rights to access, correct, delete, port, and object to processing of their data, honored within set timeframes.
- Vendors processing data on a customer's behalf are bound by a Data Processing Agreement (DPA); violations carry fines up to 4% of global revenue.
GDPR reframes personal data as something individuals own and merely lend to organizations. It applies extraterritorially: any company processing the personal data of people in the EU must comply, regardless of where the company is based. Its principles include lawful basis for processing, data minimization (collect only what you need), purpose limitation, and accountability — you must be able to demonstrate compliance, not just assert it.
It grants data subjects concrete rights: to access the data held about them, to correct it, to have it erased (the right to be forgotten), to receive it in a portable format, and to object to certain processing. Organizations must be able to honor these requests within defined timeframes, which requires knowing exactly what data they hold and where.
When a vendor processes personal data on a customer's behalf, the relationship is governed by a Data Processing Agreement (DPA) that contractually binds the processor to GDPR obligations. Breaches must be reported promptly, and serious violations carry fines large enough to be existential.
Planoda supports GDPR compliance through a Data Processing Agreement and data-subject controls, so customers can meet their own obligations when their users' personal data is processed on the platform.
Related terms
- SOC 2SOC 2 is an auditing standard from the AICPA that assesses how a service organization handles customer data against five trust service criteria: security, availability, processing integrity, confidentiality, and privacy. A SOC 2 report, produced by an independent auditor, is the common way SaaS vendors demonstrate to customers that their controls are designed and operating effectively.
- Encryption at RestEncryption at rest protects data while it is stored — on disks, in databases, in backups — by keeping it encrypted so that anyone who gains physical or low-level access to the storage cannot read it without the keys. It complements encryption in transit, which protects data moving over the network, to give end-to-end protection across a data's lifecycle.
- Audit TrailAn audit trail is an append-only, time-ordered record of who did what, when, and to which object across a system. Every create, edit, delete, and approval is logged immutably, so any state can be traced back to the actions that produced it. Audit trails underpin accountability, debugging, compliance, and — increasingly — oversight of what AI agents do.
- Row-Level Security (RLS)Row-level security (RLS) is a database feature that restricts which rows a query can read or modify based on the current user or context. Instead of relying solely on application code to filter data, the database itself enforces access policies on every query — a strong defense for multi-tenant systems where one workspace's data must never leak to another.
- Principle of Least PrivilegeThe principle of least privilege holds that every user, service, or process should be granted only the minimum permissions needed to do its job — and nothing more. By default-denying access and granting narrowly, you shrink the attack surface: a compromised account or buggy component can only reach what it was explicitly allowed, limiting the blast radius of any failure.