GDPR is the EU law that decides when and how organisations may use information about an identifiable person. GDPR stands for General Data Protection Regulation, Regulation (EU) 2016/679, and it has applied since 25 May 2018. It sets rules for anyone who collects, stores or uses personal data: a lawful reason is needed, people get rights over their data, and breaking the rules can cost up to €20 million or 4% of worldwide annual turnover.
An everyday example
Imagine a small physiotherapy practice in Lyon, "Cabinet Martin". It keeps appointment times, contact details, treatment notes and invoices. Under GDPR, the practice is the controller: it decides why and how that data is used. Its booking software provider is a processor: it handles the data only on the practice's behalf.
GDPR asks the practice simple questions. Why do you hold this data? Do you need all of it? Who else sees it? How long do you keep it? Can a patient get a copy or ask for it to be corrected? If the practice can answer each one and show its paperwork, it is on the right track.
GDPR in detail, simply
Who it applies to
GDPR applies to any organisation established in the EU that processes personal data, whatever its size. It also applies to companies outside the EU that offer goods or services to people in the EU or monitor their behaviour (Art. 3(2)). A US app with European users is covered. The UK kept an almost identical version after Brexit, called the UK GDPR.
"Personal data" means any information relating to an identified or identifiable person: a name, an email address, an IP address, a patient number, a voice recording.
The seven principles (Art. 5)
- Lawfulness, fairness and transparency. Tell people what you do with their data.
- Purpose limitation. Collect data for a clear purpose and do not quietly use it for something else.
- Data minimisation. Only what you need.
- Accuracy. Keep it correct.
- Storage limitation. Do not keep it longer than necessary.
- Integrity and confidentiality. Keep it secure.
- Accountability. Be able to prove all of the above.
The six legal bases (Art. 6)
Every use of personal data needs one of these: consent, performance of a contract, a legal obligation, vital interests, a public task, or legitimate interests. Consent is only one of six, and often not the right one. Our guide to legitimate interest explains the most flexible of them.
Some data is more sensitive, such as health, religion or biometric data. Processing it is prohibited unless an exception in Art. 9 applies. Our guide to special category data explains those rules.
Your rights (Art. 15 to 22)
- Access a copy of your data.
- Correct it.
- Have it erased ("right to be forgotten"), in many cases.
- Restrict or object to processing.
- Take it with you (data portability).
- Not be subject to purely automated decisions with significant effects, with some exceptions.
Fines and other sanctions
Supervisory authorities, such as the CNIL in France, can fine up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches. Lesser breaches carry up to €10 million or 2%. Under the UK GDPR, the ICO's ceiling is £17.5 million or 4%. Authorities can also order processing to stop, and people can claim compensation. More on tiers, factors and the largest cases in GDPR fines. Personal data breaches usually have to be reported to the authority within 72 hours.
This is general information, not legal advice.
What GDPR does not protect
GDPR is strong, but it has one deliberate boundary. It protects personal data, and only personal data. Recital 26 says it plainly: data protection does not apply to anonymous information, meaning data that no longer relates to an identifiable person.
That has a large consequence. Once a dataset has been anonymised, GDPR stops applying to it. It can then be pooled, analysed, licensed and sold without asking anyone. The diagnosis, the dosage, the deal terms, the contract clause: all of it remains, only the name is gone. We show how that works step by step on our data trail page, with sources on how it is legal to sell.
Two more points are worth knowing:
- Pseudonymised is not anonymous. Replacing a name with a code still counts as personal data under GDPR. But the line between the two is often drawn loosely, and modern AI makes re-identification cheaper every year. See pseudonymisation vs anonymisation.
- Terms of service matter. A provider can be fully "GDPR compliant" and still have your agreement, in its terms, to reuse what you upload or to create anonymised data from it.
So "GDPR compliant" means the rules on identifiable data are followed. It does not mean your data is never reused.
What this means when you use AI tools
Before you paste client or patient information into any AI tool, check:
- Role. Is the provider your processor under a data processing agreement, or does it act as a controller for some purposes, such as "service improvement"?
- Licence. Do the terms grant the provider a licence to use, analyse or anonymise your content?
- Training. Is your content used to train models, by default or ever?
- Retention. How long are prompts and files kept, by the tool and by the model provider behind it?
- Location. Where is the data processed, not only where the company is registered?
Wysor answers these in its contract. We act only as your processor under Art. 28 GDPR, on your instructions. We take no licence to reuse your content, never train on it and never sell it, anonymised or not, and those commitments bind anyone who could ever own Wysor. Your data is encrypted in transit and at rest, hosted in the EU, and every connected AI model provider runs with zero data retention. You get GPT, Claude, Gemini and more in one workspace. More detail is on our GDPR-compliant AI page.
FAQ
What does GDPR stand for? GDPR stands for General Data Protection Regulation. It is an EU regulation, Regulation (EU) 2016/679, which applies directly in every EU member state since 25 May 2018.
Does GDPR apply to companies outside the EU? Yes, if they offer goods or services to people in the EU or monitor their behaviour there. A non-EU company with EU customers usually has to follow GDPR and, in many cases, appoint a representative in the EU.
What counts as personal data under GDPR? Any information about an identified or identifiable person. That includes obvious things like names and email addresses, but also IP addresses, ID numbers, location data and pseudonymised records that can be linked back to someone.
What is the maximum GDPR fine? Up to €20 million or 4% of a company's worldwide annual turnover, whichever is higher. Smaller breaches carry up to €10 million or 2%.
Does GDPR protect anonymised data? No. Recital 26 excludes anonymous information from data protection law. Once data is truly anonymised, GDPR no longer restricts how it is used, shared or sold.
Further reading
- Pseudonymisation vs anonymisation: the difference, explained simply
- What is a data processing agreement (DPA)?
- GDPR AI compliance checklist for business
- The data trail: where your data can end up
Questions about using AI with personal data? Reach us at [email protected] or through the in-app contact form.
