General Data Protection Regulation provides guidelines on storing and processing personal data. Personal data is any information about an identified or identifiable person, also known as the data subject. Personal data includes information such as their:

name
address
ID card/passport number
income
cultural profile
Internet Protocol (IP) address
data held by a hospital or doctor (which uniquely identifies a person for health purposes).

Special categories of data
You may not process personal data about someone's:

racial or ethnic origin
sexual orientation
political opinions
religious or philosophical beliefs
trade-union membership
genetic, biometric or health data except in specific cases (e.g. when you've been given explicit consent or when processing is needed for reasons of substantial public interest, on the basis of EU or national law)
personal data related to criminal convictions and offences unless this is authorised by EU or national law.

Who processes the personal data?
During processing, personal data can pass through various different companies or organisations. Within this cycle there are two main profiles that deal with processing personal data:

The data controller - decides the purpose and way in which personal data is processed.
The data processor - holds and processes data on behalf of a data controller.
Who monitors how personal data is processed within a company?
The Data Protection Officer (DPO), who may have been designated by the company, is responsible for monitoring how personal data is processed and to inform and advise employees who process personal data about their obligations. The DPO also cooperates with the Data Protection Authority (DPA), serving as a contact point towards the DPA and individuals.

Processing data for another company
A data controller can only use a data processor who offers sufficient guarantees, these should be included in a written contract between the parties involved. The contract must also contain a number of mandatory clauses, e.g. that the data processor will only process personal data when instructed to do so by the data controller.

Data transfer outside the EU
When personal data is transferred outside the EU, the protection offered by the GDPR should travel with the data. This means that if you export data abroad, your company must ensure one of the following measures are adhered to:

The non-EU country's protections are deemed adequate by the EU.
Your company takes the necessary measures to provide appropriate safeguards, such as including specific clauses in the agreed contract with the non-European importer of the personal data.
Your company relies on specific grounds for the transfer (derogations) such as the consent of the individual.
When is data processing allowed?
EU data protection rules mean you should process data in a fair and lawful manner, for a specified and legitimate purpose and only process the data necessary to fulfil this purpose. You must ensure that you fulfil one of the following conditions to process the personal data; you:

have been given the consent of the individual concerned
need the personal data to fulfil a contractual obligation with the individual
need the personal data to satisfy a legal obligation
need the personal data to protect the vital interests of the individual
process personal data to carry out the task in the interest of the public
are acting in your company's legitimate interests, as long as the fundamental rights and freedoms of the individual whose data are processed are not seriously impacted. If the person's rights override your company's interests, then you cannot process the personal data.


Agreeing to data processing - consent
Right to access and right to data portability
Right to correct and right to object
Right to erasure (right to be forgotten)
Automated decision-making and profiling
Data breaches – providing proper notification
Responding to requests
Impact assessments
Keeping a record