What Is
What Is the GDPR
The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, is the European Union's comprehensive data protection law. It was adopted April 27, 2016 and has applied since May 25, 2018.
It reaches a business with no establishment in the EU if it processes personal data of people in the Union in connection with offering them goods or services, paid or free, or monitoring their behavior in the Union (Art. 3(2)). Mere accessibility of a website from the Union does not itself amount to offering goods or services there; targeting is assessed on the facts. A business caught this way generally must appoint a representative in the EU (Art. 27).
Under the GDPR, every use of personal data needs one of six lawful bases, such as consent, contract, legal obligation, or legitimate interests (Art. 6(1)). Special categories of personal data face additional processing conditions beyond an Article 6 basis (Art. 9). Individuals have rights to access, correct, erase, and port their data and to object to certain processing (Arts. 15 to 21). A controller must notify its supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to create a risk to individuals; a notification that misses the 72-hour mark must be accompanied by reasons for the delay (Art. 33(1)).
Personal data may leave the EU only under Chapter V: to a country with an adequacy decision, under safeguards such as the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914), or under a listed exception. Transfers to U.S. companies certified under the EU-U.S. Data Privacy Framework rely on the Commission's 2023 adequacy decision (Implementing Decision (EU) 2023/1795). On September 3, 2025, the EU General Court dismissed the annulment challenge to that decision in Latombe v. Commission (T-553/23). Latombe appealed on October 31, 2025 (Case C-703/25 P). The Court's case listing identifies the appeal as pending. An appeal does not itself suspend the adequacy decision.
Fines reach EUR 20 million or 4 percent of worldwide annual turnover, whichever is higher, for the most serious violations, and EUR 10 million or 2 percent for others (Art. 83(4), (5)). The United Kingdom applies its own version, the UK GDPR, as amended by the Data (Use and Access) Act 2025.
Why it matters in Texas. A Texas company with EU customers, users, or website visitors it tracks may be subject to the GDPR without any office in Europe. The Texas Data Privacy and Security Act borrows the GDPR's controller and processor roles, but its rights, exemptions, and enforcement differ.
Pinpoint: Regulation (EU) 2016/679. Related term: Personal data under GDPR (GDPR).