GDPR

GDPR is the EU's General Data Protection Regulation, in force since May 25, 2018. It governs how any organization, anywhere, processes the personal data of people in the EU, regardless of where that organization is based.

For a mobile app, personal data covers more than most developers assume. A device's advertising ID, a precise location fix, even an IP address, all count, the same as a name or an email address.

Core principles

GDPR builds on a small number of principles rather than a long technical checklist:

• Lawfulness and transparency about why data is collected,
• Purpose limitation,
• Data minimization,
• Accuracy, and
• Storage limits.

A separate principle, accountability, requires an organization to actually demonstrate compliance, not just claim it.

Data subject rights

Individuals get specific, enforceable rights over their own data: access to what's held about them, correction, erasure (the "right to be forgotten"), portability to move data elsewhere, and the right to object to certain processing.

A mobile app needs a real, working way to honor these, not a line in a privacy policy nobody built a mechanism for.

Penalties

GDPR fines run in two tiers:

1. Up to €10 million or 2% of global annual turnover for lesser violations, or
2. Up to €20 million or 4% of global annual turnover for the most serious violations, whichever is higher in each case.

Enforcement has been active and substantial. Total fines have passed €7.4 billion since 2018, with roughly €1.2 billion issued in 2025 alone.

Unlike DORA, which leaves penalty-setting to individual EU member states, GDPR's fine structure is harmonized across the whole EU: the same maximum applies whether the case is heard in Ireland or Poland.

A simplification effort is underway, but nothing's changed yet

The European Commission proposed a "Digital Omnibus" package in November 2025, aimed at simplifying GDPR's administrative requirements, records of processing, impact assessments, breach notification, alongside changes to several other EU digital laws. None of it has taken effect.

It's still being negotiated in the European Parliament and Council, with final adoption not expected before late 2026 at the earliest. It could be worth watching, but not yet worth acting on.

Why it matters for mobile

Two things trip up mobile apps more than web apps.

Device and advertising identifiers count as personal data under GDPR, the same as a name or an email, even though many teams don't treat them that way. And a mobile app routinely hands data to third parties the moment an SDK compiles into the binary: analytics, ad networks, crash reporting, often without anyone auditing exactly what each one actually collects.

Where Appknox fits

Appknox tests what a mobile app's binary and network traffic actually reveal: which third-party SDKs are present, what data they collect and where they send it, and whether encryption and access controls meet what GDPR's security principle requires. Findings map to GDPR automatically, giving a compliance team evidence about what the app does, not just what its privacy policy claims it does.

See the full testing methodology: Appknox Automated Vulnerability Assessment.

Frequently asked questions

What does GDPR stand for?

GDPR stands for the General Data Protection Regulation, the EU law governing how personal data is collected, used, and protected. It's been in force since May 25, 2018.

Does GDPR apply to companies outside the EU?

Yes, if they process the personal data of people located in the EU. The company's location doesn't matter. The location of the people whose data is processed does.

How much can a GDPR fine cost?

Up to €10 million or 2% of global annual turnover for lesser violations, up to €20 million or 4% for the most serious, whichever is higher. Total fines have passed €7.4 billion since 2018.

Is the Digital Omnibus part of GDPR now?

No. It's a proposed simplification package still being negotiated as of 2026. None of its changes have taken effect yet.

Does Appknox test for GDPR compliance?

Appknox tests what a mobile app's binary and network traffic reveal about data collection and third-party sharing, and maps findings to GDPR automatically.

Related: What is DORA? | What is HIPAA? | Appknox Automated Vulnerability Assessment

By Aadarsh Anand, Security Researcher, Appknox Security Research Team

Appknox is an enterprise mobile application security testing platform. This page was written by Appknox's security research team based on direct experience testing mobile apps for GDPR-relevant data collection and third-party exposure across financial services, healthcare, and enterprise mobile app portfolios. This page was drafted with AI assistance and reviewed and verified by the Appknox security research team.