--- title: "What is GDPR?" description: "What is GDPR? The European data protection law that sets a lawful basis for using personal data and gives people rights over it. See the full definition." url: https://assistbpo.com/glossary/gdpr/ updated: 2026-09-20 publisher: AssistBPO (SS Support Network LLC) language: en-US --- # What is GDPR? Glossary What is GDPR? GDPR, the General Data Protection Regulation, is the European Union's data protection law; the UK retains a near-identical UK GDPR. It requires a lawful basis for every use of personal data, gives individuals rights of access and erasure, restricts transfers outside the region, and requires breach reporting within 72 hours. The Information Commissioner's Office (ICO) enforces UK GDPR. Updated September 2026 · Reviewed by [Nimra Khalid](https://assistbpo.com/team/nimra-khalid/) ## How does GDPR work? 1. The business names a lawful basis (consent, contract, legitimate interests and so on) for each processing activity and records it. 2. A data processing agreement (DPA) binds any vendor, including a remote assistant provider, to act only on the client's instructions. 3. Transfers to staff outside the UK or EEA need a transfer mechanism such as the UK International Data Transfer Agreement plus a risk assessment. 4. Individuals can ask for a copy of their data or its deletion, usually within one month, and the vendor must help the client respond. 5. Personal data breaches likely to cause risk are reported to the ICO within 72 hours of discovery. ## A worked example A Bristol recruitment agency with eight consultants brings on a remote coordinator to schedule interviews and update candidate records in Bullhorn. Before access is granted, the agency and the staffing provider sign a DPA with the UK IDTA attached, and the agency documents a transfer risk assessment covering the provider's second office. The coordinator's Bullhorn role can view and edit candidate contact details but cannot export the database. When a candidate emails asking what data the agency holds, the coordinator logs it as a subject access request and hands it to the office manager the same day. ## Where does GDPR show up in your tools? GDPR shows up as a DPA schedule in vendor contracts, as consent and lawful-basis properties in HubSpot and Mailchimp, as data-retention settings in Zendesk and Salesforce, and as the export and delete tools used to answer subject access requests. ## Common mistakes - Signing a generic NDA and assuming it covers processing; GDPR needs a DPA with the specific clauses the regulation lists. - Forgetting that a remote assistant in another country is an international transfer, even when the data never leaves the client's cloud software. - Keeping candidate or customer data forever because nobody set a retention rule. ## Why does GDPR matter? UK GDPR fines can reach 4% of global turnover, but the more common cost for a small firm is a complaint, an ICO inquiry and the time it takes to answer. A DPA, a transfer mechanism and a short retention policy cover most of the risk of using remote staff. This is a plain-language summary, not legal advice. ## How does AssistBPO handle GDPR? AssistBPO signs a data processing agreement with every UK and EU client, with the International Data Transfer Agreement attached because assistants work from outside the UK, and gives clients the information they need for their transfer risk assessment. Assistants use managed devices with no local storage, so client data stays inside the client's own systems. [How we protect your business](https://assistbpo.com/security/)[Get a staffing plan](https://assistbpo.com/get-a-staffing-plan/) ## Related terms - [PECR](https://assistbpo.com/glossary/pecr/) - [PIPEDA](https://assistbpo.com/glossary/pipeda/) - [Privacy Act (Australia)](https://assistbpo.com/glossary/privacy-act-australia/) - [Non-disclosure agreement](https://assistbpo.com/glossary/non-disclosure-agreement/) ## Where it is used - [How we protect your business](https://assistbpo.com/security/) ## Next in the A to Z - [Help desk](https://assistbpo.com/glossary/help-desk/) - [HIPAA](https://assistbpo.com/glossary/hipaa/) - [Hours bank](https://assistbpo.com/glossary/hours-bank/) - [Inbox zero](https://assistbpo.com/glossary/inbox-zero/) [All 148 terms, A to Z](https://assistbpo.com/glossary/) Next step ## Your desk, staffed. Wherever you are. Tell us what is overloaded. A named person replies within 1 business day with a staffing plan, and we propose your assistant within 72 hours. [Get a staffing plan](https://assistbpo.com/get-a-staffing-plan/) [Book a 20-minute call](https://assistbpo.com/book-a-call/) Or call [+1-657-777-0006](tel:+16577770006) during US, UK or Australian business hours, or [hear our demo receptionist](https://assistbpo.com/demo-line/). - A named assistant proposed within 72 hours - Employed, screened and managed staff, never freelancers - Your hours, your tools, your data --- Source: https://assistbpo.com/glossary/gdpr/ · Contact: https://assistbpo.com/contact/ · Full site map for agents: https://assistbpo.com/llms.txt