The General Data Protection Regulation (GDPR), which came into force on 25 May 2018, replaced the patchwork of national data protection laws across the EU with a unified system that greatly increased the fines regulators could issue, strengthened the requirements for consent to data processing, and created a new pan-European data regulator called the European Data Protection Board.

The regulation governs the processing and storage of EU citizens' data whether or not the company has operations in the EU. To ensure companies comply, GDPR also gives data regulators the power to fine up to €20m, or 4% of annual global turnover. In the UK, the previous maximum fine was £500,000; the post-GDPR record currently stands at more than £180m, for a data breach reported by British Airways in 2018.

Data breaches must be reported within 72 hours to a data regulator, and affected individuals must be notified unless the data stolen is unreadable. Fines can also be levied against companies that act on data without explicit and informed user consent, or who fail to ensure that consent can be withdrawn at any time.

GDPR also refined and enshrined in law the concept of the "right to be forgotten", renaming it as the "right to erasure", and gave EU citizens the right to data portability, allowing them to take data from one organisation and give it to another.