The GDPR is a new regulation seeking to unify data protection across the EU. It incorporates significant and new requirements for governing data and how it is used, collected, retained and shared. This will apply to all data controllers and data processors in the EU. The new data protection law would apply to the data processed by an organisation situated within the EU. Additionally, the Regulation will have an extraterritorial effect.
An organisation can be fined up to 4% of annual global turnover or €20 Million (whichever is greater) for non compliance.