What does GDPR stand for? GDPR stands for the General Data Protection Regulation, the main law in the European Union governing how organizations collect, use, store and share personal data about people in the EU. It also gives those people rights over their own information.
The law reaches beyond Europe. A company based in the United States can fall under it if it offers goods or services to people in the EU or tracks their behavior online. That is one reason Americans see GDPR in privacy notices, cookie banners and work trainings.
Quick facts
Stands for
General Data Protection RegulationType
InitialismHow to say it
G D P R, letter by letterMade by
The European UnionCovers
Personal data of people in the EUSeen in
Privacy policies, cookie notices, compliance trainingRelated terms
PII, HIPAA, data protection officer
GDPR stands for four words
| Letter | Word | What it signals |
|---|---|---|
| G | General | Covers nearly all kinds of personal data and organizations |
| D | Data | Information about people |
| P | Protection | The goal is to protect that information |
| R | Regulation | An EU law that applies directly in every member country |
"Regulation" matters here. In EU law, a regulation applies the same way across all member countries without each one passing its own version. The GDPR replaced an older EU directive from 1995 that countries had carried out in different ways.
What does GDPR stand for in practice?
In daily life, the law shows up as a set of principles. Organizations must have a lawful reason to use personal data, such as consent, a contract or a legal duty. They should collect only what they need, keep it accurate, keep it secure and keep it no longer than necessary. They must also tell people clearly what they do with it.
"Personal data" is broad. It includes names, email addresses, location data, account numbers, online identifiers and photos, plus special categories like health information that get extra protection. In the United States, a similar idea is often called PII, personally identifiable information.
Your rights under the GDPR
- Access: ask a company for a copy of the data it holds about you.
- Correction: have wrong data fixed.
- Erasure: ask for data to be deleted in certain cases, often called the right to be forgotten.
- Portability: get your data in a form you can move to another service.
- Objection: say no to some uses, such as direct marketing.
A privacy request: A traveler who shopped online while living in Europe writes, "Under the GDPR, please send me a copy of my personal data." The company must generally answer within one month.
Who has to follow the GDPR
The law covers organizations in the EU and many outside it. A business in Texas that ships to customers in Germany, or a website that tracks visitors from France, may be covered. Companies often name a data protection officer to oversee their compliance. If there is a serious data breach, they generally must report it to the authorities within 72 hours.
Enforcement comes from national data protection authorities in each EU country. Fines for serious violations can be large, up to a percentage of a company's worldwide yearly turnover. After leaving the EU, the United Kingdom kept a closely matching law known as the UK GDPR.
GDPR vs US privacy laws
The United States has no single law like the GDPR. Instead, privacy is covered by laws for specific areas and by state laws.
| Law | Made by | Scope |
|---|---|---|
| General Data Protection Regulation, or GDPR | EU law | Personal data of people in the EU |
| Health Insurance Portability and Accountability Act, or HIPAA | US law | Medical records held by US providers and insurers |
| Family Educational Rights and Privacy Act, or FERPA | US law | Records kept by US schools that get federal funds |
How to say and write GDPR
Lawyers and IT teams alike say "G D P R," one letter after another, and the letters are printed uppercase without dots. People say both "GDPR" and "the GDPR"; in formal writing, "the GDPR" is common because it names a specific law. It also sits in front of other nouns, as in "GDPR compliance" or "a GDPR request."
For more laws and agencies known by their letters, see our government acronyms.
Questions people ask
Does the GDPR apply in the United States?
It is an EU law, but it can apply to US companies that offer goods or services to people in the EU or track their behavior. It does not cover data about people in the US in general.
What is the main purpose of the GDPR?
Its purpose is to protect personal data and give people control over how it is used. It sets rules for organizations and rights for individuals.
Why do websites show cookie banners because of the GDPR?
Many cookies collect data that counts as personal, and EU rules often require consent for them. Sites show banners to ask for that consent.
What is the difference between GDPR and HIPAA?
The GDPR covers almost all personal data of people in the EU. HIPAA covers health information held by certain US health care groups and their partners.
Is it GDPR or the GDPR?
Both are used. "The GDPR" is more common in formal and legal writing, since it is the name of one specific regulation.