GDPR comes into force

New data protection rules giving people more control over their personal information have come into force across the European Union, including the United Kingdom.

The General Data Protection Regulation, known as GDPR, took effect on 25 May. In Britain, it is accompanied by a new Data Protection Act.

What changes?

The regulation strengthens people's rights over the information organisations hold about them. People can ask to see the data held about them free of charge, have it corrected, ask for it to be deleted in some circumstances and object to it being used for marketing.

Organisations must have a clear legal basis for using personal data, and where they rely on consent, it must be freely given, specific and clearly shown. Pre-ticked boxes are no longer allowed.

Companies must also report serious data breaches to the regulator within 72 hours.

Bigger fines

The penalties for breaking the rules have increased sharply. Regulators can now fine companies up to 20 million euros or four per cent of their global turnover, whichever is higher. Under the previous law in Britain, the maximum fine was £500,000.

In Britain, the rules are enforced by the Information Commissioner's Office, led by Elizabeth Denham.

Email overload

In the weeks before the deadline, many people received a flood of emails from companies asking them to confirm that they wanted to stay on mailing lists. Some organisations have deleted large parts of their databases rather than risk breaking the rules.

Some American websites have temporarily blocked visitors from Europe while they work out how to comply.

After Cambridge Analytica

The new rules come after a year of concern about how personal data is used online. In March, it emerged that the political consultancy Cambridge Analytica had obtained data from millions of Facebook users without their knowledge.

Facebook's chief executive, Mark Zuckerberg, was questioned by the American Congress and has apologised. The company says it is making changes to give users more control over their information.

After Brexit

The government has said the rules will continue to apply in Britain after it leaves the European Union, so that data can continue to flow freely between Britain and Europe.

Businesses, especially small ones, have complained about the cost and complexity of preparing for the changes, but supporters say they will help restore trust in how personal data is handled.