GDPR,
Every Click Leaves a Trace. Who’s Watching Your Data?
One fine morning, I woke up and realised I needed to order a few things for my upcoming birthday, some shoes and a new outfit. I opened an e-commerce website, and while signing in, I was asked to check a few boxes:
☑️ I agree to the Terms & Conditions
☑️ I agree to the Privacy Policy
As a normal user, I checked the boxes and moved forward. I chose what I wanted, completed my shopping, and successfully placed my order.
But even after placing the order, I was asked one more question:
“Would you like to receive personalized offers based on your purchase history?”
[Yes] [No]
I simply thought, “Okay, they are just asking me whether I want offers or not.” So, I made my choice and moved on. But have you ever stopped to think about why they are asking these questions in the first place?
Why do they need your personal information?
What exactly happens to the information you share?
Who can access it?
And most importantly, do you really have control over your own data?
How much of our personal information are companies actually collecting? like Name, email, phone number, location, IP address, purchase history, search history, preferences, online behavior. Every time we use a digital product, we leave behind pieces of information about ourselves.
WHAT EXACTLY IS GDPR?( General data Protection Regulations )
In simple words, GDPR is a set of data protection rules created it is an EU data protection law designed to give people greater control over their personal data and place obligations on organizations that process it. It gives European Union (EU) to give people more control over their personal information. It tells companies what they can and cannot do with a person’s data. This includes how they collect, use, store, share, and protect personal information.
SITUATION TO UNDERSTAND, Imagine you give your house key to a friend and ask them to enter your house only to feed your dog while you’re away. You gave them access to your house for a specific purpose i.e feeding your dog. That doesn’t mean they can use your key to enter your house whenever they want, invite their friends over, or use your belongings for their personal needs. You expect them to use the key only for the purpose you gave it to them, keep it safe and not give it to someone else. Your personal data works in a similar way.
Get Bhavana’s stories in your inbox
Join Medium for free to get updates from this writer.
So similarly, For example, when you place an order, you give an e-commerce company your name, phone number, and address. The company needs this information to process and deliver your order. It should use your data for legitimate purposes related to the service, rather than using it for unrelated purposes or sharing it with another company without a valid legal basis. GDPR creates rules around how organizations should handle that “key.”
To Understand this pattern deeply, we need to look after some legal basis and some key principles,
A company needs a valid legal basis to process personal data, and it depends on the purpose of use. For example, promotional calls may require consent, while using personal information in an emergency to protect someone’s life can fall under vital interests. similarly we have set of legal basis which are,
- Consent: User gives permission. Example: Agreeing to receive promotional emails.
- Contract: Data is needed to provide a service. Example: Using your address to deliver an order.
- Legal obligation: The law requires the data. Example: Keeping financial records for taxes.
- Vital interests: Data protects someone’s life. Example: Using information to provide emergency medical help.
- Public task: Data is needed for official public work. Example: A government body processing data for a public service.
- Legitimate interests: Data is needed for a valid business reason. Example: Using data to prevent fraud.
A very simple way to think about it:
Company wants to use your data
↓
Why?
↓
Find the appropriate legal basis
↓
Process the data according to GDPR requirements.
If we as a users we think about how much control we have on our own data, so answer to this question is GDPR gives users more control over their personal data. They can ask to access, correct, delete, or restrict the use of their data, and in certain situations, they can object to how their data is being used.
“If GDPR is a European Union regulation, what data protection law is used in India?”
India has its own data protection law called the Digital Personal Data Protection (DPDP) Act, 2023. It is designed to protect people’s digital personal data and give them certain rights over their information. However, GDPR and the DPDP Act are different laws with different rules. An Indian company may also need to follow GDPR if it processes the personal data of people in the EU in situations where GDPR applies.
Why do Product Managers need to understand GDPR?
This is where GDPR becomes useful to a Product Manager.
GDPR helps a PM think about privacy while designing the product, instead of thinking about privacy only after the product has been built. It encourages the team to collect only the data they need, use it for appropriate purposes, keep it secure, and give users the rights and information they are entitled to.
So, for a Product Manager, GDPR is not just a legal checklist. It can become a way of asking:
“Are we building this feature in a way that respects the user’s data?”
This approach is often described as privacy by design and by default.
And there is a bigger product benefit too: when users understand what data you’re collecting, why you’re collecting it, and how you’re protecting it, you can build greater trust in the product.
In simple words: GDPR helps Product Managers balance three things:
What the user needs → What the product needs → What the user’s privacy requires.
