New EU rules under the GDPR
What has applied to businesses since May 2018
Since 25 May 2018, the General Data Protection Regulation (GDPR) has applied directly in all EU member states.1 The most noticeable change: fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher.1 LamaPoll is happy to summarise the other changes for you.
Table of Contents
What changed in 2018?
The GDPR replaced the EU Data Protection Directive 95/46/EC and applies directly throughout the EU. Germany’s Federal Data Protection Act (BDSG) still exists: it was rewritten in 2018 and now only covers what the GDPR leaves to the member states, such as data protection officers or video surveillance.2 The data protection acts of the German federal states also remain in force and have been amended accordingly.
What does the GDPR mean for businesses that create or commission online surveys?
Before the survey, define its purpose clearly and collect only the data you need for it (Art. 5 GDPR). You need a legal basis, usually the participants’ consent or a legitimate interest (Art. 6). When the survey starts, tell participants who processes their data, for what purpose, and what rights they have (Art. 13), including access, rectification and erasure (Art. 15–17). They can withdraw their consent at any time (Art. 7(3)). If you use a service provider such as LamaPoll, you need a data processing agreement (DPA) with it (Art. 28).1
LamaPoll works exclusively with sub-processors based in Germany. Its ISMS is certified by TÜV SÜD to ISO/IEC 27001:2022, 27017 and 27018.3 LamaPoll also holds a TISAX label at Assessment Level 2 (AL2).
Status in 2026
Regulation (EU) 2025/2518 entered into force on 1 January 2026. It harmonises how supervisory authorities handle cross-border cases and will apply from 2 April 2027.4 In November 2025, the European Commission proposed amendments to the GDPR as part of the “Digital Omnibus”, including changes to the definition of personal data and to data breach notification. Nothing has been adopted yet; until then, the GDPR continues to apply unchanged.5
For transfers of personal data to the USA, see Data Privacy Framework: data transfers to the USA and Data processing within and outside the EU.
Further information on the General Data Protection Regulation
Sources and references:
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
- https://www.gesetze-im-internet.de/englisch_bdsg/
- https://www.lamapoll.de/cdn/media/files/LamaPoll-ISO-Certificate_27001_27017_27018-62366ms27001_english.pdf
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R2518
- https://www.europarl.europa.eu/legislative-train/theme-a-new-plan-for-europe-s-sustainable-prosperity-and-competitiveness/file-digital-package
