GDPR
EU General Data Protection Regulation (2016/679) — the EU law governing personal data of individuals in the EU.
The GDPR is an EU regulation that took effect 25 May 2018. It applies to any organisation that processes personal data of individuals in the EU, regardless of the organisation's location. Fines reach up to €20M or 4% of global annual turnover (whichever is higher). Core principles: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality, accountability.