A regulation (set of rules) drafted by the EU. All EU Member States must follow these rules. It sets out rules for data protection and privacy for all individuals within the EU. The GDPR includes rules for how physical or legal persons may process personal data.

The purpose of the regulation is to create a uniform and harmonised level of protection for personal data within the European Union. So the free movement of personal data within Europe is not limited.

The full name of the regulation is REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.