--- title: GDPR Primer — General Concepts description: As an industry-leading vendor in data protection, disaster recovery and storage, Acronis has some unique perspectives on the implications of GDPR on end-users, businesses and service providers. Let’s review some of GDPR’s general terminology. It will help you understand challenges and identify opportunities presented by the new regulation. canonical_url: https://www.acronis.com/en/blog/posts/gdpr-primer-general-concepts/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # GDPR Primer — General Concepts The European Union’s new General Data Protection Regulation (GDPR) is coming into effect on May 25, 2018 and it’s going to affect every business and institution that captures the personal information (like payment card data or government identification numbers) of individual EU citizens. In a digital age in which customer data is considered a core asset, businesses will be forced to review their procedures and technology infrastructure to ensure that data is processed and managed to comply with these new regulations or face stiff financial penalties. [Learn More](https://www.acronis.com/en/products/cyber-protect/) [![Image 2: John Zanni](https://staticfiles.acronis.com/images/content/4ebd2c6ab90855a20d45286557169382.png)](https://www.acronis.com/en/blog/authors/john-zanni/ "John Zanni") [John Zanni](https://www.acronis.com/en/blog/authors/john-zanni/) 3 min read Last updated 17 November 2017 The European Union’s new General Data Protection Regulation (GDPR) is coming into effect on May 25, 2018 and it’s going to affect every business and institution that captures the personal information (like payment card data or government identification numbers) of individual EU citizens. In a digital age in which customer data is considered a core asset, businesses will be forced to review their procedures and technology infrastructure to ensure that data is processed and managed to comply with these new regulations or face stiff financial penalties. From its position as an industry-leading vendor in [data protection](https://www.acronis.com/en-us/resource-center/resource/data-protection/), [disaster recovery](https://www.acronis.com/en-us/business/disaster-recovery-service/) and [storage](https://www.acronis.com/en-us/business/software-storage/), Acronis has some unique perspectives on the implications of GDPR on end-users, businesses and [service providers](https://www.acronis.com/en-us/cloud/service-provider/). These will be covered in a series of blogs, webinars, and whitepapers that Acronis will publish in the coming weeks. For now, let’s review some of GDPR’s general terminology. It will help you understand challenges and identify opportunities presented by the new regulations: * **Data subject****—** “_an identified or identifiable natural person… who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”_ These are your customers, partners, consumers, or just website visitors if they are citizens of the EU. (Have you noticed that many websites have started to ask for permission to collect personal data about your visit and store it in a cookie?) * **Personal data —** any information that can be used to identify the data subject. This goes well beyond the historical definition of personally-identifiable information to include the person’s name, email address, social media posts, physical, physiological, or genetic information, medical information, location, bank details, IP address, cookies, cultural identity, etc. * **Controller —**“_the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data_.” If you have customers or website visitors who are citizens of the EU, this is you. * **Processor —**“_a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller_.” If you are a service provider, storage vendor, or other company that manages and/or stores the personal data of EU data subjects on behalf of a company that is a controller (as defined above), you are a processor. Note that companies can be both controllers and processors. Acronis, for example, provides infrastructure to some service providers as the basis of their cloud backup services, but also has a backup product that it sells online to consumers; thus we are both a controller and a processor in EU GDPR terms. * **Right to be forgotten**— The right of _data subject_ _“to have his or her personal data erased and no longer processed.”_ Individuals may request the deletion of all of their personal data stored on a controller’s servers. There is some ambiguity between data backup (for disaster recovery) and data archiving (for legal data retention compliance), which we hope will be clarified in the coming months. There are hefty penalties for failing to remove the personal data within a specified timeframe. * **Personal data breach** — _“A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.”_ An example of this is a ransomware attack that takes down your database server, encrypting all of your customer data. Businesses must report every data breach incident to the appropriate EU regulatory authority within 72 hours of becoming aware of it. Of course, there are many more terms and definitions that you need to become familiar with if your business falls under the [GDPR](https://www.acronis.com/en-us/blog/posts/general-data-protection-regulation-explained) regulatory umbrella. These can be found at the official European Union Law website or another, more user-friendly site. What’s next? Whether you’re a [service provider](https://www.acronis.com/en-us/cloud/service-provider/) offering [data protection services](https://www.acronis.com/en-us/business/enterprise-solutions/) to European businesses or a business serving EU citizens, Acronis wants to empower you to store and operate on regulated personal data in a fully GDPR-compliant manner. Acronis offers products and services to make your data protection and storage [GDPR](https://www.acronis.com/en-us/blog/posts/general-data-protection-regulation-explained)-compliant; in the coming weeks, we will explain how. [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) [Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/) ## Written by ![Image 3: John Zanni](https://staticfiles.acronis.com/images/content/4ebd2c6ab90855a20d45286557169382.png) John Zanni [Previous post](https://www.acronis.com/en/blog/posts/5-reasons-why-fast-backup-critical-your-business-survival/) [5 Reasons Why Fast Backup is Critical for Your Business Survival](https://www.acronis.com/en/blog/posts/5-reasons-why-fast-backup-critical-your-business-survival/) [Next post](https://www.acronis.com/en/blog/posts/acronis-machine-learning-improves-ransomware-detection/) [Acronis Machine Learning Improves Ransomware Detection](https://www.acronis.com/en/blog/posts/acronis-machine-learning-improves-ransomware-detection/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 4: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 5: Introducing New Acronis CEO: Prakash Panjwani](https://staticfiles.acronis.com/images/blog-card/30cb571f6f1aaa131733e5727a4a250c.png) [Introducing New Acronis CEO: Prakash Panjwani](https://www.acronis.com/en/blog/posts/introducing-new-acronis-ceo-prakash-panjwani/) We are pleased to announce the appointment of our new Chief Executive Officer, Prakash Panjwani. A veteran cybersecurity CEO, Panjwani previously served as CEO of WatchGuard Technologies and SafeNet. **October 15, 2026**2 min read ![Image 6: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read