GDPR

GDPR, the General Data Protection Regulation, is the European Union’s comprehensive data-privacy law, in force since May 2018, that governs how organizations collect, process, and store the personal data of people in the EU. It grants individuals concrete rights over their data — access, correction, erasure, portability — and imposes strict obligations on the organizations handling it, backed by penalties that can reach into the tens of millions of euros or a percentage of global revenue. Its reach is extraterritorial: it applies to any organization anywhere that processes EU residents’ data.

• Data-subject rights - Access, rectification, erasure (“right to be forgotten”), and portability of one’s personal data.
• Lawful basis for processing - Every use of personal data must rest on a defined legal basis such as consent or legitimate interest.
• Data minimization and purpose limitation - Collect only what is needed, and use it only for the stated purpose.
• Breach notification and accountability - Reportable breaches within 72 hours, plus a duty to demonstrate compliance.
• Extraterritorial scope - Applies to any organization processing EU residents’ data, regardless of where the organization sits.

GDPR lands directly on API design and governance because APIs are where personal data actually moves. It pushes teams to classify which fields are personal or sensitive — increasingly with machine-readable markers like PII annotations in an OpenAPI definition — to scope access tightly, to log and honor deletion and portability requests, and to think about data residency in how endpoints are hosted. In the agentic turn, where autonomous agents can call APIs and move data at scale, GDPR’s principles of purpose limitation and accountability become part of what any responsible API governance program has to enforce, not just document.