The individual owns its personal identifiable information (PII)

Companies must regard PII as borrowed, not owned

Accountability - Companies must be able to show why and how PII is used

Transparency - The right to pull stored PII

Rectification - The right to update information

Forgettability - The right to be forgotten

Portability - The right to have PII exported

All PII must be handled in a way that is legal, correct and transparent

Data can only be collected for certain purposes:Consent (must be documented, specific, optional and revokable)AgreementLegitimate Interest

The scale of collection must fit the purpose

Data must be correct and up to date

Data cannot be stored in a form that enables identification for a length of time beyond the purpose of the data collection

Data must be processed in a safe manner

Privacy by Design

Privacy by Default

Breach and Incident handling processes

Designated Data Protection Officer

Documentation of all Data Processing and Data Processors

The entity originally controlling the data

Bear primary responsibility for compliance with EU law

Must be able to demonstrate compliance with Data Protection Principles

Any 3rd party that processes data on behalf of the controller

All data processors must fulfil GDPR Processor Requirements

Data transfer allowed within the EU and some selected countries, such as Norway

Data transfer outside the EU is generally prohibited, unless:the jurisdiction in which the recipient is located is deemed to provide an adequate level of data protectionthe data exporter puts in place appropriate safeguards; ora derogation or exemption applies