What does GDPR stand for?
GDPR stands for General Data Protection Regulation. The European Union's data protection law, which governs how organizations anywhere handle EU residents' personal data: lawful basis, consent, breach notification within 72 hours, data subject rights and heavy fines. Network+ treats it as a key compliance driver for data handling and locality.
The GDPR is the European Union's data protection law, Regulation (EU) 2016/679, which applies since 25 May 2018. It governs how organizations collect, use and store personal data: any information that relates to an identified or identifiable living person. It reaches beyond Europe, because an organization established outside the EU is covered when it offers goods or services to people in the EU or monitors their behaviour. For IT staff the daily effects are access control, keeping only the data that is needed, and breach handling: a personal data breach must be reported to the data protection authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals.
GDPR in practice: an example
A web shop based in Canada sells to customers in France and Germany. On a Friday evening its administrator discovers that an exposed backup contained names, addresses and order histories. Although the company has no office in Europe, the GDPR applies because it sells to people in the EU, and the 72 hours for notifying the authority started when the company became aware of the breach.
What GDPR is confused with
GDPR vs PII: what is the difference?
PII is a term, used mostly in the United States, for data that identifies a person. The GDPR is a law, and its own term, personal data, is broad: the European Commission lists an IP address and a cookie ID among its examples. What PII stands for
GDPR vs PCI DSS: what is the difference?
PCI DSS is an industry standard for protecting payment card data, applied through contracts with the card brands. The GDPR is a law that covers the personal data of people in the EU and is enforced by regulators.
Which exams cover GDPR?
GDPR is on the official CompTIA acronym list for one of the four exams covered here.
- Network+ N10-009: 4.0 (Network Security).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A company discovers a breach of customer personal data covered by the GDPR. Where notification is required, within what time must it notify the data protection authority?
- Within 72 hours of becoming aware of it
- Within 30 days of the end of the quarter
- Within one year
- There is no deadline
Show the answer
A. Within 72 hours of becoming aware of it. The deadline is 72 hours from the moment the organization becomes aware of the breach, and any delay has to be justified.
2. A company with no offices in Europe runs an online service marketed to people in Spain. Does the GDPR apply to its handling of their personal data?
- Yes, because it offers services to individuals in the EU
- No, because its servers are outside the EU
- No, because it has no European office
- Only if it also sells hardware
Show the answer
A. Yes, because it offers services to individuals in the EU. The regulation covers organizations outside the EU when they offer goods or services to individuals in the EU or monitor their behaviour. The location of the servers does not decide it.
Sources: European Commission: Legal framework of EU data protection (Regulation (EU) 2016/679); European Commission: Data protection explained; European Data Protection Board: Data breaches. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 12 November 2026.