What Exactly is the GDPR?

The General Data Protection Regulation (GDPR) is a law and data protection regulation designed for individuals within the European Union. It builds upon previous EU privacy measures but is lot more stringent in a number of ways:

• Stronger emphasis on user consent: companies will need an explicit statement from users for their data to be collected. It will certainly mean a complete revamping of Terms of Service and the way users interact with your website.
• More transparency over collected data: users must be able to download all the data a company has gathered on them. This feature has already been rolled out by a number of companies such as Facebook or Google.
• Hefty penalty fines: set at 4% of a company's global turnover (or $20 million - whichever is larger) a violation fine could completely sink a young startup, and put a big dent into an established firm's net profits.
• Worldwide effect: technically speaking, the GDPR is only enforced for citizens of the European Union. But the global nature of data on the Internet means everyone is likely to be affected.
• Hard deadline: While there has been a two year transition period since it was adopted, the GDPR comes into full effect on the 25th of May 2018.

What is the CCPA?

The CCPA or California Consumer Privacy Act is the data protection law that will come into force in the State of California on January 1, 2020. It is the strongest and most restrictive privacy law passed in the United States to date, but its practical future is still somewhat uncertain. The level of enforcement is such that the California Attorney General must determine by July 2020 at the latest.

Any company that does business in California will be required to comply with the CCPA. And rather than create multiple systems, many companies will just use compliance with the CCPA as a baseline and the right will be given to citizens of other U.S. states, de facto. Discussion of a national U.S. data privacy law is in its early stages, too.

• The right of Californians to know what personal information is being collected about them.
• The right of Californians to know whether their personal information is sold or disclosed and to whom.
• The right of Californians to say no to the sale of personal information.
• The right of Californians to access their personal information.
• The right of Californians to equal service and price, even if they exercise their privacy rights.

What is the ePR?

The proposed EU Regulation on Privacy and Electronic Communications (commonly known as the ePrivacy Regulation or ePR) will replace the 2002 ePrivacy Directive (the 'cookie law') and all member state laws that implement it, including the UK's PECR (Privacy and Electronic Communications (EU Directive) Regulations 2003).