Glossary›Data Governance, Retention, and Risk›GDPR

GDPR

Why does GDPR matter for companies outside Europe?

Because it applies to any organization that handles personal data of people in the European Union, wherever the organization is based, when it offers them goods or services or monitors their behavior. A US company with European customers, users, or employees can be covered. That includes personal data sitting in files, not only in databases.

How does GDPR apply to unstructured data?

GDPR covers personal data wherever it is held, and much of it sits in files: documents, spreadsheets, scans, saved emails, and exports. Rights such as access and erasure require an organization to find a person’s data across all of that storage. In practice, that means knowing which files are likely to hold personal data, where they are, who owns them, and how long they must be kept, so requests and retention rules can be met.

What is CCPA?

CCPA stands for the California Consumer Privacy Act, the state privacy law in effect since 2020 and expanded by the California Privacy Rights Act in 2023. It gives California residents the right to know what personal information a business holds about them, to have it deleted, and to opt out of its sale. The obligation lands on the file estate in the same way GDPR does. Answering a consumer request means locating every copy of that person’s data across shared drives, archives, and backups.

What is the difference between GDPR and CCPA?

GDPR covers people in the European Union and applies to nearly every organization holding their personal data. CCPA covers California residents and applies to businesses that meet a size or revenue threshold. The rights differ in the detail, but the operational demand is the same. Find every file holding a named person’s data, show what happened to it, and delete it on request when the law requires.

Is there a US equivalent of GDPR?

The United States has a patchwork rather than a single federal law covering all personal data the way the General Data Protection Regulation (GDPR) does. Twenty-four states had passed comprehensive privacy laws by June 2026, up from twenty at the start of the year, with Alabama, Louisiana, Oklahoma, and Vermont the most recent additions. Several of those laws have future effective dates, so the number in force is lower than the number passed. Alongside the state laws sit older federal rules for particular sectors such as health and finance, which apply regardless of state.

What is PHI, and how does HIPAA apply to file data?

PHI stands for protected health information: health data that can be linked to a person, protected in the United States by the Health Insurance Portability and Accountability Act (HIPAA). In file estates, PHI sits in scans, medical images, exports, and research files, often copied across shares and archives. Complying with HIPAA starts with knowing where those files are, so a file index flags likely PHI from metadata signals, such as path, format, and location, for a person to review.

How do you find personal data for a GDPR request?

By searching every place the person’s data could be. Databases can be queried directly, but files are harder: names and email addresses sit in documents, spreadsheets, and exports across many systems. A metadata catalog narrows the search to likely locations, such as folders by owner, department, or project, and content search tools then confirm which files contain the person’s data.

← Back to Data Governance, Retention, and Risk

Last updated: November 13, 2026.