Règlement général sur la protection des données de l'UE

The EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, is the European Union's comprehensive data protection law. It governs how organisations collect, use, store, and share the personal data of individuals in the EU, and applies directly across all Member States. Its reach is extraterritorial: it binds any organisation, wherever established, that offers goods or services to people in the EU or monitors their behaviour.

GDPR entered into force on 24 May 2016 and has applied since 25 May 2018, replacing the 1995 Data Protection Directive. It is built on principles such as lawfulness, fairness and transparency, purpose limitation, data minimisation, and accountability, and it grants individuals strong rights over their data. Enforcement sits with independent national Data Protection Authorities, coordinated by the European Data Protection Board, and the regime is backed by some of the highest administrative fines in EU law.