General Data Protection Regulation (GDPR)

The GDPR refers to Europe’s strict, new data privacy and security law that came into effecton May 25, 2018; this regulation effectively replaced the EU’s Data Protection Directive which first came into effect in 1995. Among the toughest privacy and security laws in the world, GDPR “requires businesses to protect the personal data and privacy of EU citizens for transactions that occur within EU member states.” All companies which store or process personal information of EU citizens, including basic identity information, web data, biometric data, health and genetic data, political opinions, sexual orientation and racial or ethnic data, must comply with this regulation, regardless of whether the company itself is physically present within the EU. Failure to offer a “reasonable” level of protection for personal data could result in substantial fines.