The General Data Protection Regulation (GDPR) is a legal framework established by the European Union (EU) in 2016 and effective since 2018 that sets rules for the collection, processing, and protection of personal data of individuals within the EU and European Economic Area (EEA). It aims to give individuals control and rights over their personal data and holds companies accountable for data handling, regardless of where the company is based or operates. The GDPR applies to any business or organization worldwide that offers goods or services to people in the EU/EEA or monitors their behavior within these regions. It also provides strict data security and privacy requirements, with significant penalties for noncompliance, including fines up to 4% of a company's global annual turnover or €20 million, whichever is greater.