General Data Protection Regulation (GDPR)

The GDPR is Regulation (EU) 2016/679 on the protection of personal data and has applied since 25 May 2018. For security, Art. 32 (technical and organisational measures) and Art. 33 are particularly relevant: personal data breaches must be reported to the supervisory authority within 72 hours. A cyber incident is therefore often also a data protection incident.