A logistics firm confuses the GDPR with a voluntary industry code of conduct. Which characterisation is correct?
Select an answer to reveal the explanation.
Short Explanation
A voluntary code is a handshake; the GDPR is law with rights, supervisors, and real fines. Logistics teams that treat it like a nice-to-have charter are setting themselves up for a hard landing. Binding regulation — full stop.
Full Explanation
The GDPR is a binding EU regulation with enforceable data-subject rights and administrative fines—not a voluntary industry code of conduct. Logistics firms that treat it as optional guidance misunderstand direct applicability and the supervisory enforcement toolkit. Publishing a privacy poem on a website does not let a company ignore the Regulation. The GDPR does not bind only trade associations while sparing individual controllers or processors. It is not enforceable solely through social-media shaming with no supervisory authorities. Voluntary codes of conduct can support compliance under the Regulation, but they do not convert the GDPR itself into soft law. Exam caveat: binding-regulation versus voluntary-code distractors are common—pick enforceability and SA powers. Operational check: in vendor onboarding, require GDPR role language, Article 28 terms where processing occurs, and rights-handling SLAs; do not accept a marketing code-of-conduct badge as a substitute for contractual processor duties. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.