General Data Protection Regulation (GDPR)

The General Data Protection Regulation, formally Regulation (EU) 2016/679, is the European Union's data protection and privacy regulation, adopted by the European Parliament and the Council of the European Union on 27 April 2016 and applicable across the EU from 25 May 2018. As a regulation rather than a directive it has direct legal effect in every member state with no national transposition law required. It requires that personal data be processed lawfully, fairly and transparently, collected for specified purposes, minimized to what is necessary, kept accurate, retained no longer than needed, and secured against unauthorized access, with organizations required to demonstrate compliance. It grants individuals enforceable rights including access to their data, erasure, and data portability, and it applies extraterritorially to any organization worldwide that processes the personal data of people located in the EU or offers them goods or services. Violations carry fines of up to twenty million euros or four percent of a company's global annual turnover, whichever is higher. It is widely regarded as the most consequential modern data protection regulation, having directly influenced comparable laws including Brazil's LGPD and the United States' California Consumer Privacy Act.