GDPR

The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy for all individuals within the European Union (EU) and the European Economic Area (EEA). It came into effect on May 25, 2018, and replaced the previous Data Protection Directive 95/46/EC.

The GDPR aims to strengthen and unify data protection laws across the EU and EEA by providing individuals with more control over their personal data and introducing stricter rules on how organizations collect, use, store, and transfer personal data. It sets out a number of key principles that organizations must follow when processing personal data, including the need for explicit consent from individuals, the right to access and rectify personal data, and the requirement to notify individuals of any data breaches.

The GDPR applies to all organizations that process personal data of EU and EEA citizens, regardless of where the organization is based. It imposes significant penalties for non-compliance, including fines of up to 4% of a company's global annual revenue or €20 million (whichever is greater).

Overall, the GDPR is intended to provide greater protection for individuals' personal data and enhance their rights in relation to how their data is used and processed by organizations.