GDPR (General Data Protection Regulation), known in Poland as RODO (Rozporządzenie o Ochronie Danych Osobowych), is EU Regulation 2016/679 that sets out how organisations may collect and use people’s personal data. The European Parliament adopted it on 27 April 2016, and it has applied since 25 May 2018 across all EU member states. As a regulation it applies directly — it does not need to be rewritten into national law, although countries may add their own clarifications (in Poland, the 2018 Personal Data Protection Act).

What does the GDPR cover and who does it apply to?

The GDPR protects personal data — any information about a specific person, or about someone who can be identified. That is more than a name: it also covers an identifier, an IP address, location data and online identifiers. It singles out sensitive data (e.g. health, ethnic origin, beliefs, biometric data) and protects it more strictly (Art. 9).

The rules apply broadly (Art. 3). They cover companies and institutions based in the EU, but also organisations outside the EU if they offer goods or services to people in the EU or track their behaviour. The GDPR distinguishes two roles. The controller decides why and how data is processed. The processor does it on the controller’s behalf, under a data processing agreement (Art. 28) — this is how, for example, a cloud provider or an outsourced IT firm fits in.

What are the GDPR principles under Article 5?

Article 5 sets out seven principles. The controller must follow them and be able to show it:

Lawfulness, fairness and transparency — you need a legal basis, you must act fairly, and you must tell people clearly what happens to their data.
Purpose limitation — data is collected for a specific, stated purpose, not gathered “just in case”.
Data minimisation — you take only as much data as you genuinely need.
Accuracy — data must be correct and kept up to date where necessary.
Storage limitation — data is kept no longer than it is needed.
Integrity and confidentiality — data must be protected against unauthorised access, loss and destruction.
Accountability — the controller is responsible for compliance and must be able to document it.

Accountability ties it all together. Acting lawfully is not enough — you must be able to prove it, through records of processing activities (Art. 30), impact assessments and policies.

What are the lawful bases for processing (Article 6)?

You cannot process data “just because”. Every processing operation must rest on at least one of six lawful bases in Art. 6:

Consent — freely given, specific, informed and unambiguous; it can be withdrawn at any time.
Performance of a contract — when the data is needed to carry out a contract or to prepare for one.
Legal obligation — when the law requires the processing (e.g. tax or employment rules).
Vital interests — protecting someone’s life or health.
Public task — a task carried out in the public interest or under official authority.
Legitimate interests of the controller or a third party — provided they are not overridden by the person’s rights and freedoms (this requires a balancing test).

Special categories of data (Art. 9) have a narrower set of conditions — for example explicit consent, employment law, or medical purposes.

What rights do data subjects have?

The GDPR gives people concrete rights over their own data:

Right to information (Arts. 13–14) and access (Art. 15).
Right to rectification of inaccurate data (Art. 16).
Right to erasure — the “right to be forgotten” (Art. 17).
Right to restriction of processing (Art. 18).
Right to data portability in a structured, commonly used format (Art. 20).
Right to object to processing, including direct marketing (Art. 21).
Right not to be subject to solely automated decisions, including profiling (Art. 22).

What security obligations does Article 32 impose?

Article 32 says the controller and processor must put in place appropriate technical and organisational measures — matched to how big the risk is. The regulation explicitly lists:

pseudonymisation and encryption of personal data,
the ability to ensure the confidentiality, integrity, availability and resilience of systems,
the ability to restore access to data quickly after a failure or incident,
a process for regularly testing and assessing whether those measures actually work.

The GDPR mandates no specific technology. It takes a risk-based approach and tells you to weigh the state of the art, the cost of implementation, and the severity of the risks to people’s rights.

How does data breach notification work?

A personal data breach is an incident where data is accidentally or unlawfully destroyed, lost, altered, or disclosed to someone who should not have it. The GDPR sets two paths here:

Notification to the supervisory authority (Art. 33) — without undue delay and, where feasible, within 72 hours of becoming aware of the breach. The exception: when the breach is unlikely to put people’s rights and freedoms at risk. In Poland the authority is the President of the Personal Data Protection Office (PUODO/UODO).
Communication to the affected people (Art. 34) — when the breach is likely to pose a high risk to their rights and freedoms.

Those 72 hours have real technical consequences. To make the deadline, you have to be able to detect an incident and scope it quickly — this is no longer just a legal matter but an operational one. This is where the GDPR meets security monitoring directly.

Who is the Data Protection Officer (DPO)?

The Data Protection Officer is the person who keeps an eye on whether processing complies with the GDPR. You must appoint one (Art. 37) when: data is processed by a public authority; the core activities involve regular, systematic monitoring of people on a large scale; or the core activities involve large-scale processing of sensitive data. The DPO acts independently, advises, and is the contact point for the supervisory authority.

What are the penalties for GDPR violations?

The GDPR provides for administrative fines at two tiers (Art. 83):

Lower tier: up to EUR 10 million or 2% of annual worldwide turnover (whichever is higher) — e.g. for gaps in records, weak security, or processor failings.
Higher tier: up to EUR 20 million or 4% of annual worldwide turnover (whichever is higher) — for breaching the processing principles, lacking a lawful basis, violating people’s rights, or breaking the rules on transfers outside the EEA.

The highest GDPR fine imposed to date was EUR 1.2 billion, issued to Meta Platforms Ireland in 2023 in connection with transfers of EU/EEA user data to the United States. Other major fines include Amazon (EUR 746 million), Meta/Instagram (EUR 405 million), TikTok (EUR 345 million), and WhatsApp (EUR 225 million). In addition to administrative fines, individuals who suffer damage also have the right to seek compensation under Article 82.

How does the GDPR relate to ISO 27001 and NIS2?

The GDPR says what must be achieved (data security matched to the risk), but not how. ISO/IEC 27001 gives you a ready-made framework for managing information security (an ISMS) and is often used to meet the Art. 32 requirements. The certificate itself, though, is not formal proof of GDPR compliance — it is a strong argument when demonstrating accountability, but not a free pass.

The NIS2 Directive regulates the cybersecurity of essential and important entities and imposes its own obligations, including incident reporting. NIS2 and the GDPR can look at the same incident from different angles: NIS2 protects service continuity and security, while the GDPR protects the rights of the people whose data leaked. In practice, a single incident may require two separate reports.

Why does the GDPR matter for network monitoring and security?

The GDPR is a legal act, but it has very concrete technical effects. The integrity and confidentiality principle (Art. 5), the Art. 32 measures, and the 72-hour notification deadline (Art. 33) all require you to detect a breach, classify it, and scope it almost in real time. Network telemetry, access logs and traffic monitoring help here — they let you establish whether someone gained unauthorised access to data, how far they reached, and whether data was taken out (exfiltration).

There is a catch, though. The telemetry itself — things like IP addresses or online identifiers — is often personal data under the GDPR. So security monitoring must itself comply with the regulation: it needs a legal basis, it should collect only what is necessary, and it must not keep logs longer than needed.

Learn more

Data Loss Prevention (DLP) — DLP helps prevent unauthorized disclosure of personal data covered by GDPR.
Data Retention — Data retention policies help meet GDPR storage limitation and deletion requirements.
Data mining — Data mining may process personal data, so GDPR rules on lawful processing apply.
BYOD (Bring Your Own Device) — BYOD can expose personal data on unmanaged devices, raising GDPR security risks.
PCI-DSS — PCI-DSS protects card data, while GDPR also applies if payment data identifies a person.
Deep Packet Inspection — Deep Packet Inspection can inspect personal data, so GDPR limits and safeguards may apply.

RODO / GDPR