What is the name of the legal framework for data protection implemented in the EU in 2018?

The legal framework for data protection implemented in the EU in 2018 is the General Data Protection Regulation. Usually called the GDPR, it is Regulation (EU) 2016/679 and governs how organizations collect, process, store, and transfer personal data.

The European Parliament and Council adopted the regulation on 14 April 2016. It entered into force in May 2016, but its provisions became directly applicable across EU member states on 25 May 2018 after a two-year transition period. Unlike an EU directive, the GDPR did not require each country to transpose the entire framework into separate national legislation.

The GDPR strengthened rights such as access, correction, deletion, data portability, and objection to certain processing. It also introduced stricter obligations for organizations and potentially severe penalties for violations. Although it is an EU law, it can apply to organizations outside the EU when they offer services to, or monitor the behavior of, people in the EU.

A common mix-up is confusing the GDPR with California's CCPA, which is a separate United States privacy law enacted in 2018.