GDPR: The General Data Protection Regulation, an EU law in force since 2018 that sets rules for processing personal data of people in the European Union and gives individuals rights over that data.
Also known as: General Data Protection Regulation, RGPD, Regulation (EU) 2016/679
Key takeaways
- GDPR applies to organizations in the EU and to many outside it that offer services to, or monitor, people in the EU.
- Its core principles include lawfulness, purpose limitation, data minimization, storage limitation and security.
- Work chat is personal data processing: names, numbers, photos, locations and message content.
- Monitoring employee messages needs a clear purpose and transparency; C Chat keeps direct messages private.
- C Chat does not claim GDPR compliance on your behalf; assess it with your counsel.
GDPR is the reason most websites ask about cookies, but its real weight falls on everyday operations. Every time a supervisor posts a staff rota, a technician shares a client’s address or a manager reviews a group conversation, personal data is being processed. If your company has people or customers in Europe, it helps to understand the basics.
GDPR: a plain definition
GDPR is a regulation adopted by the European Union that has applied since May 2018. It defines personal data broadly (any information relating to an identified or identifiable person, see PII) and sets rules for anyone who processes it. Its seven principles are:
- Lawfulness, fairness and transparency
- Purpose limitation: use data only for the purposes you stated
- Data minimization: collect only what you need
- Accuracy
- Storage limitation: keep it no longer than necessary
- Integrity and confidentiality: protect it with appropriate security
- Accountability: be able to demonstrate all of the above
How it works
GDPR assigns responsibilities by role. The organization that decides why and how data is processed is the controller; a service provider that processes data on its behalf is the processor. The difference matters a lot in practice, and it is explained in data controller vs data processor.
Processing needs a lawful basis, such as a contract, a legal obligation or a legitimate interest. Individuals have rights over their data, and organizations must secure it, report certain breaches and, in some cases, carry out impact assessments. Moving personal data outside the European Economic Area is also regulated, which is why buyers ask about data residency.
Why it matters for business messaging
Messaging touches nearly every GDPR principle:
- Minimization: does the app need the whole address book, or just enough to find colleagues?
- Storage limitation: how long are chats kept, and who decides? See data retention.
- Transparency: do employees know who can read which conversations?
- Security: how are messages protected in transit and at rest?
- Rights: can a person get their account and data deleted?
Employee monitoring is a sensitive area. Many European regulators expect monitoring to be proportionate and announced in advance, and some countries add labor-law requirements. The guide on GDPR considerations for workplace messaging goes through these questions.
How it relates to C Chat
C Chat does not claim GDPR compliance or certification. Instead, here are the facts you can assess:
- Minimized contact discovery: phone numbers are hashed with SHA-256 on the device, and the server does not store the hashes.
- Security: TLS in transit and AES-256 at rest with a key per organization.
- Clear visibility rules: team owners and admins can audit and export group conversations; direct messages between people are private. That split makes it easier to tell staff exactly what is reviewable.
- Limited platform access: content is accessed only for moderation of reported messages or legal requirements, and that access is logged.
- Account deletion is available at getcchat.com/delete-account.
- Retention: C Chat does not offer configurable retention settings; see data retention in C Chat.
C Chat is operated by CGuard Pro LLC in Texas, USA. The compliance overview and the privacy policy describe the current practices.
Related terms and common misconceptions
- “GDPR bans employee monitoring.” It does not ban it outright; it sets conditions. National employment law may add more.
- “Encryption means GDPR doesn’t apply.” Encrypted personal data is still personal data.
- “Deleting everything solves GDPR.” You may also have duties to preserve records, for example under a legal hold. The guide on legal hold and eDiscovery covers how both duties interact.
When you evaluate any vendor, the vendor security questionnaire lists GDPR-related questions worth asking.
Getting started
Tell your team in writing which conversations are reviewable and which are private, then move work into a tool where that is enforced. Create a team in the web app at getcchat.com/c; it is free for now within the limits on the pricing page.
Frequently asked questions
Does GDPR apply to companies outside the EU?
It can. GDPR applies to organizations established in the EU and also to organizations elsewhere that offer goods or services to people in the EU or monitor their behavior there. Whether it applies to you is a question for your counsel.
Is it legal to monitor employees' work chats under GDPR?
Monitoring can be lawful in some circumstances, but it generally needs a legitimate purpose, proportionality and transparency toward employees, and some countries add their own employment rules. Get legal advice before you start reviewing staff messages.
What are the main rights GDPR gives individuals?
They include the right to be informed, to access their data, to rectification, to erasure in certain cases, to restrict processing, to data portability and to object. Organizations must have a way to receive and answer these requests.
Does using C Chat make my company compliant with GDPR?
Compliance depends on how your organization uses a tool, not just on the tool. C Chat does not claim a GDPR certification. It provides TLS in transit, AES-256 at rest with per-organization keys, private direct messages and auditable group conversations, which you can assess with your counsel.
What is the difference between GDPR and RGPD?
None in substance. RGPD is the Spanish (and French, Portuguese and Italian) abbreviation of the same regulation: Reglamento General de Protección de Datos.