GDPR Fundamentals

The General Data Protection Regulation (GDPR) is the world's strongest data protection law, governing how organizations process personal data of EU residents. Its principles have influenced privacy legislation worldwide.

Key Principles: • Lawfulness, fairness, transparency: You need a legal basis for processing personal data • Purpose limitation: Collect data only for specified, explicit purposes • Data minimization: Collect only what you need • Accuracy: Keep personal data accurate and up to date • Storage limitation: Don't keep data longer than necessary • Integrity and confidentiality: Protect data with appropriate security measures • Accountability: Demonstrate compliance through documentation

GDPR applies to any organization processing EU residents' data, regardless of where the organization is based. Penalties for non-compliance can reach €20 million or 4% of global annual turnover.

Encryption Under GDPR

GDPR doesn't mandate specific encryption standards, but it strongly incentivizes encryption:

Article 32(1)(a): Controllers and processors must implement "the pseudonymisation and encryption of personal data" as appropriate security measures.

Article 34(3)(a): If a data breach occurs but the data was encrypted, you may be exempt from the requirement to notify affected individuals directly.

This means encryption isn't just good security — it's a compliance tool that reduces regulatory risk:

• Zero-knowledge encryption (like ZeroLatch's) provides the strongest GDPR compliance benefit — even if the service is breached, the data is indecipherable without the user's key • Client-side encryption ensures the processor never accesses plaintext data, simplifying Data Protection Impact Assessments • AES-256 encryption is recognized as an appropriate encryption standard by EU regulators

Individual Rights and Dead Man's Switches

GDPR grants individuals several rights over their personal data. Here's how they interact with dead man's switches:

Right to Access (Article 15): Users can request all data a service holds about them. ZeroLatch's zero-knowledge architecture means we hold only encrypted data — we can provide the encrypted blobs, but not the plaintext.

Right to Erasure (Article 17): Users can request deletion of their data. Services must honor this by deleting all user data and vaults.

Right to Data Portability (Article 20): Users can request their data in a portable format. Dead man's switch services should support data export.

Rights of Deceased Persons: GDPR itself doesn't address deceased persons' data, but some member states (like France's CNIL guidelines) extend certain rights to heirs. A dead man's switch provides a privacy-respecting mechanism for post-death data access.