GDPR
The European Union's data protection law, which governs how organizations collect, use and protect personal data about people in the EU.
In short
- It applies to organizations outside the EU too, if they offer goods or services to people in the EU or monitor their behavior.
- Every use of personal data needs a lawful basis, such as consent, contract or legitimate interest.
- Fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher.
The General Data Protection Regulation, or GDPR, has applied across the European Union since May 2018. It sets rules for processing personal data: any information that identifies a person, such as a name, email, card number or the contents of a receipt tied to someone's account. The United Kingdom kept a near-identical version, the UK GDPR, after leaving the EU.
Core principles
- Lawful basis: each use of personal data must rely on one of six bases, such as consent, performance of a contract, legal obligation or legitimate interest.
- Purpose limitation and minimization: collect only what is needed, for a stated purpose.
- Storage limitation: keep data only as long as necessary.
- Security: protect data with appropriate technical and organizational measures.
- Accountability: be able to show how you comply.
Rights of individuals
People can ask to access their data, correct it, delete it, restrict or object to its use and receive it in a portable format. Organizations must respond, usually within one month.
Why finance teams care
Receipts, invoices, expense reports and payment data all contain personal information. Choosing suppliers who process that data, deciding how long to keep it and handling cross-border transfers all fall under GDPR when EU residents are involved. Retention for tax purposes is a valid legal basis, but it has to be documented and limited to what the law requires.
Quebec's Law 25 follows similar principles and is often compared with GDPR.
Worked example
A Canadian company with EU customers
A Montréal software company sells subscriptions to customers in France and Germany. Because it offers services to people in the EU, GDPR applies to their data. It documents its lawful bases, signs data processing agreements with its suppliers, uses approved transfer mechanisms for data stored outside the EU, and sets retention periods that match tax requirements.