The General Data Protection Regulation (GDPR) is a comprehensive data privacy law enacted by the European Union that governs how organizations collect, process, and store personal data of EU residents. It grants individuals significant rights over their data and imposes strict obligations on organizations, with substantial penalties for non-compliance.