The General Data Protection Regulation (GDPR) is EU Regulation 2016/679, in force since May 2018. It governs how organisations process the personal data of individuals in the EU and EEA — including non-EU businesses that target or monitor EU residents. GDPR sets out six lawful bases for processing and grants a set of enforceable data subject rights including access, erasure, portability, and objection. Fines run in two tiers: up to €10 million or 2% of global turnover, and €20 million or 4% for breaches of core principles or rights. National data protection authorities enforce it, coordinated by the EDPB.