General Data Protection Regulation

The General Data Protection Regulation (GDPR) is the European Union's comprehensive data privacy framework that came into force in 2018, establishing strict rules for the collection, processing, and transfer of personal data. It is the most influential piece of digital regulation in the world, not merely because of its extraterritorial reach — it applies to any organization processing EU residents' data regardless of where the organization is based — but because it has become the template for data protection laws across dozens of jurisdictions. The GDPR's most consequential provisions include the right to erasure ('right to be forgotten'), the requirement for explicit consent, the mandate for data protection impact assessments, and the right to data portability (Article 20). The regulation has been criticized for imposing compliance costs that disproportionately burden small organizations while creating the illusion of user control through consent mechanisms that users rarely read or understand. Its real legacy may be the normalization of data protection as a legal discipline, even as the technical and economic structures of the digital economy remain largely unchanged.