In short
Data protection refers to the protection of personal data against misuse, unauthorised access and unlawful processing. At its core is every person's right to decide for themselves who collects, stores and uses which information about them, known in German law as the right to informational self-determination.
In the European Union, data protection has been governed bindingly since 2018 by the General Data Protection Regulation (GDPR), which applies to all companies that process data of people in the EU, regardless of where the company itself is based.
It is important to distinguish two terms that are often confused. Data protection governs whether and how personal data may be processed at all; it is a legal question. Data security describes the technical and organisational measures used to protect data: encryption, access control, backups. Data security is the tool, data protection the goal.
What is personal data?
Personal data is any information relating to an identified or identifiable person. This is broader than many people think. It includes obvious details as well as less obvious ones:
- Name, address, email address, telephone number
- Location data, IP addresses and device identifiers
- Order history, payment data, customer accounts
- Cookies and tracking IDs that follow behaviour across websites
Sensitive data such as health information, religious or political beliefs and biometric data is particularly protected. Stricter rules apply to it.
The most important GDPR principles
The GDPR is built on a handful of basic principles that every data processing operation must meet:
| Principle | Meaning |
|---|---|
| Lawfulness | Every processing operation requires a legal basis (e.g. consent, contract) |
| Purpose limitation | Data may only be used for the purpose for which it was collected |
| Data minimisation | Only the data that is really necessary is collected |
| Storage limitation | Data is deleted when the purpose no longer applies |
| Transparency | Data subjects must be informed in an understandable way |
In addition, there are the rights of data subjects: access to stored data, rectification, erasure (the "right to be forgotten"), data portability and objection. Companies must answer these requests within set deadlines.
Obligations for companies
Anyone who processes personal data has specific obligations. These include a transparent privacy policy, a record of processing activities, technical and organisational protective measures and, above a certain size or for particularly sensitive processing, a data protection officer. If service providers are involved who process data on the company's behalf (such as a hosting provider or a newsletter tool), a data processing agreement is required. And if a data breach occurs, it must usually be reported to the supervisory authority within 72 hours.
A concrete example from e-commerce
An online shop wants to analyse its customers' purchasing behaviour in order to improve product recommendations. In a data protection-compliant way, this means: on the first visit, a cookie banner actively asks for consent to analytics and marketing cookies, with a genuine choice rather than a preselected "Accept all". Order data is only stored for as long as tax and commercial law retention periods require. In their account, the customer finds a function with which they can obtain access to their data and delete their account. The shipping provider used and the email marketing tool are integrated via data processing agreements. None of this is spectacular, but each of these points is the difference between clean operation and a risk of fines.
Why data protection is more than meeting obligations
Data protection is often perceived as tiresome bureaucracy. This view falls short. Infringements can result in severe fines: the GDPR provides for up to four per cent of global annual turnover. At least as important is trust: customers are more willing to share their data if they are sure that it will be handled carefully. A well-thought-out approach to data is therefore not only risk avoidance but also a competitive advantage. The "privacy by design" approach (building data protection into software and processes from the outset instead of bolting it on later) is therefore the economically smarter route.
Classification
Data protection is not a peripheral IT topic but a basic prerequisite for any digital business activity. Anyone who builds software, runs an online shop or uses AI systems almost inevitably processes personal data, and is therefore responsible for doing so in a legally compliant and trustworthy way. The binding legal framework for this is provided by the full text of the General Data Protection Regulation (GDPR). Anyone who considers data protection early and seriously saves themselves expensive rework and gains what is hardest to win back in digital commerce: the trust of customers.