The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy. It imposes strict rules on how personal data can be collected, stored, and used. Non-compliance can result in heavy fines and class action lawsuits.