The General Data Protection Regulation (GDPR) is a data privacy and security law that was introduced in May 2018. Passed by the European Union, it imposes strict guidelines on how organisations collect and store the personal data of individuals.