Definition
The General Data Protection Regulation GDPR is a comprehensive data privacy and protection law enacted by the European Union. It establishes strict rules for how organizations collect, process, store, and transfer personal data of EU residents, granting individuals significant rights over their information. GDPR operates by requiring explicit consent for data processing, mandating data breach notifications, and imposing hefty fines for non-compliance. Understanding GDPR is crucial for designing secure systems and ensuring legal adherence, especially when dealing with international data flows. For instance, a company must obtain clear consent before using customer data for targeted advertising, even if the customer is outside the EU but the data pertains to an EU resident. It is often confused with data security policies, but GDPR is a legal framework that dictates *what* data must be protected and *how*, not just the technical controls. This regulation is a key topic in cybersecurity certifications like Security+, CySA+, and CISSP.