EU and UK GDPRاللائحة الأوروبية GDPR

The General Data Protection Regulation (اللائحة العامة لحماية البيانات), or GDPR, is the European law governing the processing of people's data. In practice it means every processing needs a lawful basis, and consent is one of six rather than the only one.

A common mistake begins with a sign-up screen that asks for consent to every form of processing.

Why not just ask consent for everything and be safe?

This is what most developers do: put a consent screen at signup, have the customer accept, and assume safety.

The surprise is that consent is the weakest legal basis, not the strongest.

Consent has to be freely given, explicit, specific, and withdrawable at any moment as easily as it was granted. If the customer cannot use the service at all without agreeing, it is not freely given, and it can fall apart entirely under review.

Worse, it is withdrawable. Imagine you built your transaction records on the customer's consent and they then withdraw it. What do you do with records you are legally obliged to keep for five years? You now sit between two contradictory obligations, and you created the problem yourself.

The truth is that most of what you do needs no consent. Performing a contract is a legal basis. A legal obligation is a legal basis. Legitimate interest is a legal basis. When you keep a transaction record because the law requires it, do not ask the customer, because their refusal changes nothing and asking implies a choice they do not have.

Save consent for what is genuinely optional: marketing messages, advertising trackers, and sharing data with a third party the contract does not require.

Scope follows the person and the market

The EU General Data Protection Regulation applies to an organisation established in the Union when it processes data in the context of that establishment. It also reaches an organisation outside the EU when it offers goods or services to people there, or monitors their behaviour there. A Riyadh FinTech pricing in euros and marketing to France can therefore be in scope without a European office.

A passing visit from a European person to a local website does not alone prove that the company targeted the market. Language, currencies, delivery, directed campaigns, and the customer base together reveal the intended audience. The company's location is not the only test, and the person's nationality is not the test. Their location during the offer or monitoring and the way the activity is directed matter.

Six doors to processing

The GDPR (اللائحة العامة لحماية البيانات) provides six lawful bases for ordinary personal data. Three are contract, legal obligation, and protection of vital interests. The others are public task or official authority, legitimate interests (المصالح المشروعة), and valid consent.

The right basis is not whichever sounds easiest in the notice. It is the one that describes why the processing is genuinely necessary, selected before processing starts. A product may rely on different bases for different purposes, but one purpose cannot carry all six as reserves to be invoked after an objection.

Contract covers processing objectively necessary to deliver what the customer requested. A bank needs identity and contact details to open and operate an account. It cannot call behavioural advertising necessary to the contract merely by adding it to the terms. The test is whether the core service can be delivered without that extra processing.

Legal obligation covers duties imposed on the organisation by EU or member-state law. Required transaction retention or a prescribed check may fit. An internal commercial instruction or supplier contract is not enough because the obligation must come from applicable law.

Legitimate interests require a balance

Legitimate interests can support necessary processing serving a real interest of the company or another party. The person's rights must not override it. Fraud prevention, network security, and some direct marketing can fit. The label is not a magic phrase for processing that otherwise lacks justification.

The practical test has three documented stages. Identify the interest precisely. Ask whether a less intrusive method could achieve it. Then balance the effect, the person's expectations, and the safeguards. A surprising feature, use of sensitive data, an effect on a child, or denial of a financial service pushes the balance toward the person.

A customer can object to processing based on legitimate interests. The organisation must then stop unless it demonstrates compelling grounds that override the person's rights. Direct marketing is stricter and must stop after the objection. The product therefore needs an objection control and an execution path, not an unattended mailbox.

Consent comes last

Consent is valid when it is freely given, specific, informed, unambiguous, demonstrable, and as easy to withdraw as to give. A pre-ticked box, continued use of a website, or one paragraph bundling analytics, marketing, and sharing will not do. Consent is not freely given when refusing an unnecessary activity costs the person a service they need.

Consent is weaker where there is a power imbalance, such as an employer dealing with an employee or a public authority dealing with an applicant. It is also unsuitable when the organisation must process the data regardless of the person's choice. If law requires a payment company to retain a transaction, legal obligation is more honest than asking for consent whose refusal cannot be honoured.

Consent still has useful work to do. It can suit optional marketing or an optional feature using data the core product does not need. The company must record what the person accepted, when they accepted it, the wording they saw, and the withdrawal route. A withdrawal signal must then reach every relevant system and supplier.

Assess risk before building

A written assessment for processing likely to create high risk is a data protection impact assessment, or DPIA (تقييم أثر حماية البيانات). It is performed before processing begins, while the design can still change, rather than after launch and supplier selection. It describes necessity, proportionality, risks to people, and measures that reduce them.

Strong indicators include systematic and extensive evaluation producing consequential decisions, large-scale processing of special categories, and systematic monitoring of a public area. A FinTech product can combine several indicators when it analyses thousands of people's transactions to infer behaviour and then automatically accepts or rejects them.

Product, engineering, security, and the data protection officer contribute to the assessment. It is not a certificate issued by the privacy lead alone. If high residual risk cannot be reduced, the organisation consults the supervisory authority before processing instead of accepting that risk internally.

Borders do not stop the rules

An international transfer occurs when personal data becomes available to an organisation in a country outside the European Economic Area. This can happen even when a well-known cloud provider hosts the system. Encryption does not make the transfer local, although it can be an important safeguard.

The EU permits transfers to a country covered by an adequacy decision. Without adequacy, an organisation may use standard contractual clauses or binding corporate rules. Clauses require an assessment of the destination country's law and practice plus extra safeguards when needed. Signing a template does not change a foreign authority's ability to access data.

Limited derogations exist, including a transfer necessary for a particular contract or explicit consent given after the risks are explained. They are not a permanent foundation for broad daily operations. A company sending every record to a US supplier each night needs a stable mechanism and safeguards, not an exception designed for an occasional case.

The UK version is close but separate

After leaving the EU, the United Kingdom retained a domestic version called the UK GDPR, operating alongside the Data Protection Act 2018. Its principles, bases, and rights remain close to the EU version. It is nevertheless a separate law supervised by the Information Commissioner's Office.

A company may be subject to both versions when serving people in the EU and UK. It must check representation, notices, contracts, transfers, and supervisory authorities for each scope. Much of the operational control can be shared, but one compliance label does not settle both regimes.

The UK has its own adequacy decisions and transfer mechanisms. An organisation may use the British International Data Transfer Agreement or the UK addendum to the European clauses, depending on the arrangement. A vendor register should therefore distinguish EU and UK data sources and identify the mechanism covering each flow.

The ICO publishes a detailed practical guide to the UK GDPR, with checklists covering bases, rights, and assessments. It is a better starting point than a short post, but it cannot decide the product's purpose or the necessity of its fields.

The fine follows the size of the business

The EU regime has two principal penalty tiers. Breaches of some obligations can attract up to EUR 10 million or 2 per cent of annual worldwide turnover, whichever is higher. Breaches involving principles, lawful bases, rights, and transfers can reach EUR 20 million or 4 per cent, whichever is higher.

Worldwide turnover prevents a fixed amount from becoming a minor cost for a large group. Supervisory authorities also consider severity, duration, the number of people, negligence, cooperation, and earlier measures. The ceiling is not the automatic fine for every error, and a small company is not exempt from the obligations.

In the UK, the upper ceiling is GBP 17.5 million or 4 per cent of annual worldwide turnover, whichever is higher. Statutory figures can change, but the operational lesson remains: a local spreadsheet mistake can be measured against the size of the whole group.