GDPR

The General Data Protection Regulation, formally Regulation (EU) 2016/679, is the EU's core data protection law and has been in force since May 25, 2018. It applies to any organization, regardless of where it's based, that processes the personal data of people located in the EU, imposing obligations around lawful basis for processing, data subject rights (access, erasure, portability, and others), breach notification to regulators within 72 hours, and — for higher-risk or larger-scale processing — data protection officers and impact assessments. Enforcement sits with national data protection authorities, with maximum fines of the greater of €20 million or 4% of global annual turnover.