Skip to main content

Overview

GDPR Basics​

Scope and Applicability​
  • Geographical Scope: The General Data Protection Regulation (GDPR) applies to all organizations operating within the EU, as well as organizations outside of the EU that offer goods or services to, or monitor the behavior of, EU data subjects.
  • Data Subjects: GDPR protects the personal data of individuals in the EU, regardless of the individual's nationality or residence.
  • Responsibility: Both data controllers (who decide why and how data is processed) and data processors (who process data on behalf of controllers) are covered by the GDPR.
Key Principles​
  • Lawfulness, Fairness, and Transparency: Data processing should be lawful, fair, and transparent to the data subject.
  • Purpose Limitation: Personal data should be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
  • Data Minimization: The collection and processing of personal data should be adequate, relevant, and limited to what is necessary for intended purposes.
  • Accuracy: Personal data should be accurate and kept up to date with every effort to erase or rectify without delay.
  • Storage Limitation: Personal data should be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.
  • Integrity and Confidentiality: Personal data should be processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

COPPA Essentials​

Target Audience​
  • Age Limitation: The Children's Online Privacy Protection Act (COPPA) applies to the online collection of personal information from children under the age of 13.
  • Applicable Services: It includes websites, apps, and any online services that are either directed at children under 13 or knowingly collect personal information from children under 13.
Compliance Requirements​
  • Privacy Notices: Operators must provide a clear privacy policy that details their practices regarding the collection, use, and disclosure of personal information from children.
  • Parental Consent: Operators must obtain verifiable parental consent before collecting personal information from children, with some exceptions.
  • Access to Personal Information: Upon request, an operator must provide a parent with the means to review the personal information collected from their child.
  • Ability to Revoke Consent: Operators must allow parents to refuse the further use or collection of personal information from their children and to request that the operator deletes the child's personal information.
  • Maintenance of Confidentiality: Operators are required to maintain the confidentiality, security, and integrity of any personal information collected from children.
  • Reasonable Practices: COPPA requires operators to establish and maintain reasonable practices to protect the confidentiality, security, and integrity of personal information collected from children.

Compliance with GDPR and COPPA involves a deep understanding of the regulations and the implementation of adequate measures to fulfill their requirements. For businesses and services operating online, including mobile apps and websites, adapting to these regulations is critical to legally operate and provide services to their respective audiences.