--- title: "GDPR for the EU" slug: "gdpr-eu" updated: 2023-02-28T21:19:07Z published: 2023-02-28T21:19:07Z canonical: "resourceportal.antientropy.org/gdpr-eu" --- > ## Documentation Index > Fetch the complete documentation index at: https://resourceportal.antientropy.org/llms.txt > Use this file to discover all available pages before exploring further. # EU GDPR ### Who is this article for? Any organization in the EU Any organization that deals with people in the EU **The Complete EU GDPR can be found [here](https://gdpr.eu/tag/gdpr/).** The EU General Data Protection Regulation (GDPR) is adopted in the following countries: - [Countries in the EU](https://europa.eu/european-union/about-eu/countries_en) - Countries in the European Economic Area (EEA) - Norway, Iceland, and Liechtenstein The GDPR also applies to any country that has business dealings in the EU and EEA, offers goods and services in the EU, and collects data from citizens in these areas. The best practice for companies is to appoint an EU, EEA, and UK representative(s) to be knowledgeable and up-to-date with changes in regulations and to ensure compliance with the legislation. --- ### Areas of Jurisdiction - If you are operating solely in the UK, you will need to comply with the [UK GDPR](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/) and [DPA](https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted). - If you are operating solely in the EU, you will need to comply with the [EU GDPR](https://gdpr.eu/tag/gdpr/). - If you are operating both in the UK and EU, you will need to comply with both the UK and [EU GDPR](https://gdpr.eu/tag/gdpr/), in addition to the [UK DPA](https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted). --- ### Adequacy Decisions and Other Policies - The EU has given adequacy decisions to some [non-EU countries](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) that they have deemed to have strong data protection policies. - An adequacy decision is used by the European Commission to determine whether a third country (non-EU and non-EEA) offers a comparable level of protection of personal data to that of the EU GDPR. Countries with adequacy decisions will be able to receive data from the EU and EEA freely, without additional safeguards than necessary. **This means that personal data can flow from the EU and EEA to these countries.** - These include the UK (with Northern Ireland) and Switzerland. --- - Since Brexit, the UK has also adopted the Data Protection Act (DPA). The DPA works alongside the UK GDPR. For additional information, see our [UK GDPR](/v1/docs/gdpr-uk) article. --- - Switzerland, part of the Single Market and a member of the European Free Trade Area (EFTA), has adopted a policy analogous to the GDPR, the Federal Act on Data Protection (FADP). For additional information, see our [Switzerland FADP](/v1/docs/switzerland-fadp) article. --- ### GDPR Compliance Checklist - You will need *at least one* [lawful reason/basis](/v1/docs/gdpr-compliance-guide#lawful-basis-to-collect-data) to collect and process personal data. - [Legitimate interest](/v1/docs/gdpr-compliance-guide#legitimate-interest-test) will be the most common nonprofit lawful basis. - The lawful basis is to be stated on your privacy notice. - It is valuable to consider the lawful basis as it applies to the data's processing (use and keeping), not the data itself. When you run out of any of the six lawful bases to process it, you can't use or keep it anymore. - You will need a [GDPR Privacy Policy](/v1/docs/gdpr-data-protection-policy-uk) - You will need a [GDPR Privacy Notice](/v1/docs/template-privacy-notice) - A best practice is to have the privacy notice on your website and a link to the notice in your email signature. - You can check out the EU Compliance check list for US companies [here](%E2%80%8B%E2%80%8Bhttps://gdpr.eu/compliance-checklist-us-companies/). For additional guidance on GDPR compliance, see our [GDPR Compliance Guide](/v1/docs/gdpr-compliance-guide). Take note that this is an abridged version of what an organization needs to know to be GDPR compliant. Though we vet as many of our resources as possible, consult your attorney before implementing compliance or legal advice. General Data Protection Regulation is a Regulation in EU law on data protection and privacy in the EU and the European Economic Area. Any organization in the EU or UK or dealing with people in the EU or UK is expected to be compliant with GDPR regulation. ## Related - [GDPR Compliance Guide](/gdpr-compliance-guide.md) - [GDPR - Data Privacy and Security](/gdpr.md) - [Privacy Notice Template](/template-privacy-notice.md)