The General Data Protection Regulation (GDPR) standardizes data protection law across all 28 EU countries and imposes strict new rules on controlling and processing personally identifiable information. GDPR replaces the 1995 EU Data Protection Directive, and went into force on May 25, 2018.