GDPR
GDPR (General Data Protection Regulation) is a comprehensive European Union data protection law that establishes rights for individuals over their personal data and obligations for organizations that collect and process it.
Understanding GDPR
GDPR came into force in May 2018 and is the world's most comprehensive privacy regulation, influencing data protection laws globally. It applies to any organization that processes personal data of EU residents, regardless of where the organization is located — making it a global standard in practice.
GDPR establishes several key rights for individuals: the right to access their personal data, the right to correct inaccurate data, the right to delete their data ('right to be forgotten'), the right to data portability, and the right to object to certain types of processing. Organizations must respond to these requests within 30 days.
For organizations, GDPR requires: a lawful basis for processing personal data (consent, legitimate interest, contract, or legal obligation), data minimization (collecting only what's necessary), purpose limitation (using data only for the stated purpose), storage limitation (not keeping data longer than necessary), and appropriate security measures.
Data breaches must be reported to supervisory authorities within 72 hours if they're likely to harm individuals. Violations can result in fines of up to €20 million or 4% of global annual revenue, whichever is higher — creating strong enforcement incentives.
For AI systems processing email, calendar, and personal productivity data, GDPR compliance requires careful attention to consent, data minimization, and the right to deletion.
How GAIA Uses GDPR
GAIA's architecture supports GDPR compliance through data minimization (processing only what's needed), user-controlled data deletion, data portability (request an export of your data), and self-hosting (free under the noncommercial license for public bodies and non-profits; for-profit organizations need an enterprise license from the GAIA team) that keeps personal data within your jurisdiction. GAIA's source-available codebase allows full inspection of data handling practices.
Related Concepts
Data Sovereignty
Data sovereignty is the principle that data is subject to the laws and governance of the jurisdiction where it is stored, and that individuals and organizations have the right to control where their data resides and who has access to it.
Self-Hosting
Self-hosting is the practice of running software on your own servers or infrastructure instead of using a cloud-hosted service, giving you complete control over your data, configuration, and availability.
Audit Log
An audit log is a chronological, immutable record of events and actions taken by a system, providing a verifiable trail of what happened, when it happened, and who or what triggered it.
