Legal Resources

The GDPR is a comprehensive data protection law that applies to all EU citizens, regardless of where the business is located. It requires businesses to protect personal data and privacy of EU citizens for transactions that occur within EU member states.

Key Requirements

• Obtain explicit consent before collecting personal data
• Provide clear privacy notices explaining data usage
• Allow users to access, correct, or delete their data
• Implement appropriate security measures
• Report data breaches within 72 hours
• Appoint a Data Protection Officer (DPO) if required

The CCPA gives California residents new rights regarding their personal information, including the right to know what data is collected, delete data, and opt-out of the sale of their data.

Key Requirements

• Disclose what personal information is collected and how it's used
• Provide a "Do Not Sell My Personal Information" link
• Allow consumers to request deletion of their data
• Allow consumers to access their data
• Do not discriminate against consumers who exercise their rights
• Implement reasonable security procedures

Many jurisdictions require websites to obtain user consent before storing cookies or similar tracking technologies on their devices.

Best Practices

• Clearly explain what cookies are used and why
• Obtain explicit consent before setting non-essential cookies
• Provide an easy way to withdraw consent
• Keep detailed records of consent
• Make your cookie policy easily accessible
• Review and update your cookie policy regularly

Key Obligations

• Identify purposes for collecting personal information before or at collection time
• Obtain meaningful consent and make withdrawal just as easy as granting it
• Limit collection, use, and disclosure to what a reasonable person would consider appropriate
• Maintain accurate, up-to-date information and provide access on request within 30 days
• Implement safeguards proportionate to the sensitivity of the data (encryption, access controls, logging)
• Develop a breach response plan and notify affected individuals plus the OPC when risk of significant harm exists