What is the GDPR?

What the GDPR covers

The GDPR is Regulation (EU) 2016/679. The European Commission says it entered into force on May 24, 2016 and has applied since May 25, 2018. It has been added to the EEA Agreement, so it applies throughout the European Economic Area.

The law protects personal data. That means any information about an identified or identifiable person. The EU's Your Europe guide lists names, addresses, ID card numbers and IP addresses as examples. The law also applies to companies outside the EU that offer goods or services to people in the EU. The same goes for companies that monitor people's behavior in the EU.

Two roles matter most:

• The data controller decides why and how personal data is used.
• The data processor holds and handles data on the controller's behalf.

What it requires

Every use of personal data needs a legal basis. Consent is one. Others include a contract, a legal obligation and an organization's legitimate interests, within limits. Organizations must tell people who is using their data and why.

National data protection authorities enforce the law. Fines can reach €20 million or 4% of a company's global annual turnover, the European Data Protection Board says. On May 12, 2023, Ireland's regulator fined Meta €1.2 billion over transfers of Facebook users' data, Meta's annual report says. Meta said in that report that it was appealing.

Why it matters for smart glasses

The GDPR does not cover purely personal or household activity. The board's October 2026 statement says a wearer who shares a video only with family or friends is outside the law. A wearer who posts footage on a public social media account becomes a controller with full GDPR duties. Makers of the glasses and providers of linked apps and AI services stay bound either way, it says.