A European Union regulation governing the collection, use, storage, and protection of personal data belonging to individuals in the EU, including strict requirements around consent, data access rights, and breach notification.
Why it matters
GDPR applies to any company processing the personal data of EU residents, regardless of where the company itself is based, and carries substantial potential penalties — it's a primary reason many companies built formal consent management and data-minimization practices into their marketing operations in the first place.
In a sentence
"Because we have EU visitors and customers, our consent management setup and data retention policies are built to satisfy GDPR requirements, not just U.S. law."
Related terms
- Often confused with: CCPA (GDPR is EU regulation; CCPA is a California-specific state law — the two share similar underlying principles around consumer data rights but differ in specific requirements, scope, and enforcement).