Data Privacy and GDPR
Data Privacy & General Data Protection Regulation
What are data privacy and GDPR?
- Privacy principles and regulations
- GDPR = the global benchmark
- Heavy fines for violations
Taking data privacy seriously isn't about adding one more feature. It changes the order in which you plan a service. Where legal review used to come after development, you now ask 'do we really need this input field?' at the screen-design stage. The habit of collecting it now and using it later is the first to go. Fields with no defined purpose don't get a database column in the first place, and data past its retention period is designed to be destroyed without human intervention. This is where the saying personal data is a liability, not an asset comes from.
Depending on the severity of the violation, GDPR sets fines at whichever is greater: 4% of global annual revenue or EUR 20 million. Once you become aware of a breach, you must notify the supervisory authority within 72 hours, and above a certain scale you must appoint a Data Protection Officer (DPO) who holds accountability for compliance. Data subjects have six rights: access, rectification, erasure, restriction of processing, portability, and objection, and companies must in principle respond within one month. What practitioners miss most often is that consent is only one of six lawful bases for processing. Other bases, such as contract performance, legal obligation, and legitimate interests, often fit better.
Korea's Personal Information Protection Act also introduced the concept of pseudonymized data in its 2020 amendment. Pseudonymized data is still personal data, because it can be re-identified when combined with additional information. Only anonymized data that cannot be restored falls outside the regulation. Teams often blur this line and hand analysis datasets to outside vendors on the grounds that 'we anonymized it, so it's fine,' and breaches follow. Cross-border transfers also require a separate legal basis, so keep in mind that uploading customer data to an overseas SaaS tool already counts as a transfer.
The most common misconception in practice is that 'collecting a consent checkbox is enough.' Pre-checked boxes, and consent that bundles required sign-up with marketing opt-in in a single line, are treated as invalid under GDPR. Even riskier is when documents and systems don't match. The privacy policy says 'destroyed after 3 years,' yet real customer data is copied as is into the test database, or a departed employee's account is still active with open permissions. When an audit or breach hits, claiming to comply while not doing so is treated far more severely than simply not complying.
Jaryong KooMarketing PhD and leading authority on AI, data analytics, and personal branding
Seolyeong ParkGenerative AI and AX training specialist with 17 years of hands-on experience and 200+ sessions, making AI usable even for non-specialistsGDPR is the privacy regulation the European Union adopted in 2016 and put into effect in 2018. It has become the benchmark for data regulation worldwide.
Consider a hypothetical case. Company A, a Korean cosmetics e-commerce business with 240 employees, had grown its direct sales to Europe to KRW 6.2 billion (≈ US$4,638,600) a year. The problem surfaced when a German customer emailed asking the company to 'delete all of my account information.' The same person's data was scattered across four places: the member database, customer service history, an overseas marketing tool, and the logistics partner's system. No one could say how far the deletion should extend.
- An information security manager spent six weeks mapping data flows by hand and found that only 29 of the 47 fields collected at sign-up were actually used, so the other 18 input fields were removed from the screen.
- The head of legal put it bluntly: "Collecting one more consent form won't prevent this." They restated the basis for processing EU customer data as contract performance and legitimate interests. For marketing communications, they removed the pre-checked box and made it a separate opt-in.
- The dev team lead wrote a batch script that sweeps all four systems at once whenever a deletion request comes in, cutting average response time from 11 days to 3.
- A review led by the CTO found 380,000 real customer records copied into the development test DB. All were pseudonymized, and 62 active admin permissions, including 12 belonging to former employees, were revoked.
- Six months later, Company A had handled 100% of 143 EU customer access and deletion requests within the deadline. In a breach-response drill, it brought notification prep time down to 24 hours internally, against the 72-hour requirement, then passed a European distribution partner's due diligence and renewed the contract.