# GDPR Article 1: Subject-Matter and Objectives

- Source: https://support.icompaas.com/support/solutions/articles/62000236281-gdpr-article-1-subject-matter-and-objectives
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GDPR](https://support.icompaas.com/support/solutions/62000112722) › [Chapter I: General Provisions](https://support.icompaas.com/support/solutions/folders/gdpr-chapter-1-general-provisions)
- Last updated: 2026-07-11
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Overview**

This article establishes the **core purpose of the General Data Protection Regulation (GDPR)**.  
It aims to **protect individuals’ personal data and fundamental rights** while ensuring the **free movement of data** within the European Union (EU) and the European Economic Area (EEA).

  

### **Key Principles**

-   **Protection of Personal Data:** Safeguarding personal data and respecting individuals' privacy rights.
    
-   **Lawful, Fair, and Transparent Processing:** Ensuring organizations process data according to law and transparency.
    
-   **Accountability:** Organizations must demonstrate compliance with GDPR principles and be held accountable.
    
-   **Harmonization of Data Protection Standards:** Standardizing privacy protection laws across EU Member States.
    

  

### **Organizational Applicability**

This applies to **all organizations processing personal data** of EU/EEA residents, whether or not based in the EU.  
**Examples of applicability:**

-   Collection of data from EU citizens, employees, or users.
    
-   Third-party processors handling EU personal data.
    
-   Cloud or on-premises systems managing personal data.
    

  

### **Implementation Requirements**

1.  **Governance & Policy**
    
    -   Establish and communicate a **Data Protection Policy** aligned with GDPR.
        
    -   Appoint a **Data Protection Officer (DPO)** or equivalent role.
        
2.  **Data Mapping & Processing**
    
    -   Maintain a **Record of Processing Activities (RoPA)** for all personal data processing.
        
    -   Identify and classify all personal data assets.
        
3.  **Legal Basis for Processing**
    
    -   Ensure every processing activity has a **lawful basis** (e.g., consent, contract).
        
    -   Document these bases for transparency.
        
4.  **Employee Training & Awareness**
    
    -   Regular training for all staff handling personal data to ensure GDPR compliance.
        

  

### **Implementation Guidance**

-   Define and approve a **Data Protection Policy** aligned with GDPR principles.
    
-   Maintain an up-to-date **Record of Processing Activities (RoPA)**.
    
-   Conduct **DPIAs** for high-risk processing activities.
    
-   Provide **annual GDPR training** for all relevant staff.
    

  

### **Periodic Review**

-   **Frequency:** Annually or upon major changes to processing activities.
    
-   **Responsible Role:** Data Protection Officer or equivalent.
    
-   **Outcome:** Continuous compliance, up-to-date policies, and evidence.
    

  

### **Non-Compliance Risks**

-   **Financial Penalties:** Fines up to €20 million or 4% of annual global turnover (whichever is higher).
    
-   **Legal Risks:** Civil lawsuits and regulatory actions.
    
-   **Reputational Harm:** Loss of customer trust, market share, and business opportunities.

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): How the Regulation fits together as a programme — lawful bases, Article 28/30/32/33 obligations, transfers and the DPIA process.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If you also serve users in India, the DPDP Act borrows GDPR concepts but differs on consent, breach reporting and transfers.