General Data Protection Regulation (GDPR) Passed 2016, implemented 2018, the GDPR is a law on data protection and privacy in the European Union (EU) and European Economic Area. The regulation became a model for many national laws outside the EU, including CCPA.