GDPR
GDPR (Regulation (EU) 2016/679) is the EU General Data Protection Regulation, governing the processing of personal data of individuals in the EU and imposing significant fines for violations, including data breach notification obligations.
What GDPR Covers
GDPR governs how personal data of individuals in the EU is collected, processed, stored, and transferred. Core principles include lawfulness and transparency of processing, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. Data subjects have specific rights including access, rectification, erasure, restriction, portability, and objection.
The regulation applies broadly. Any organization processing personal data of EU residents falls within scope, regardless of where the organization itself is based.
GDPR and Cyber Risk
GDPR is a data protection regulation, but it has substantial cyber risk implications. Article 32 requires appropriate technical and organizational measures to ensure security of personal data. Articles 33 and 34 impose data breach notification obligations, generally within 72 hours of awareness for notification to supervisory authorities.
Fines for GDPR violations can reach 4% of global annual turnover or €20 million, whichever is higher. This makes GDPR one of the largest single regulatory drivers of cyber risk exposure for organizations processing EU personal data.
GDPR in Quantified Programs
GDPR-driven exposure appears in CRQ models as regulatory penalty potential attached to specific data breach scenarios. Quantified programs typically model penalty distributions based on prior enforcement actions, breach magnitude, and organization-specific factors.
Related Terms
Turn Cyber Risk Into Financial Exposure the Board Can Act On
Security leaders are being asked to defend budgets, prioritize controls, and report cyber risk in the same terms as every other enterprise risk. Kovrr's CRQ Platform models loss scenarios, benchmarks control performance, and gives the C-suite a defensible view of where cyber sits on the balance sheet.
