The General Data Protection Regulation ((EU) 2016/679) (GDPR) modernises and unifies EU data protection rules, replacing the EU's 1995 Data Protection Directive (95/46/EC). It strengthens individuals' rights to control their personal data and introduces new obligations on controllers and processors.

The GDPR entered into force on 24 May 2016 and became directly applicable in EU member states from 25 May 2018. It aims to harmonise data protection law in EU member states but provides derogations and exceptions for member states to introduce into their national laws.

The GDPR is part of the EU data protection reform package, along with the Law Enforcement Directive ((EU) 2016/680) (see Legal update, EU Parliament approves data protection reform package).