The General Data Protection Regulation (2016/679)—or the GDPR—was adopted for the purpose of strengthening the European Union’s (EU) procedures and practices related to data protection. While the GDPR was announced in 2012 and adopted in 2016, organisations have until 25 May 2018 to become fully compliant.
The GDPR impacts all organisations that are established in the EU, or that either offer goods or services to Europeans or monitor the behaviour of Europeans (which applies to most internet-based organisations). All such organisations must make certain they have appropriate technical and organisational measures to ensure that data is used for its intended purpose and kept secure.