Europe's sweeping data privacy law takes effect

Europe's sweeping new data privacy law, the General Data Protection Regulation, took effect this year, introducing tough new rules on how companies collect, use and protect personal data, a landmark measure with global repercussions for businesses and for the handling of personal information worldwide.

The regulation established strong protections for the personal data of individuals in the European Union, granting people greater rights over their information, requiring companies to obtain clear consent for data collection, and imposing significant obligations on organisations that handle personal data.

The law carried substantial penalties for violations, with potential fines reaching a significant percentage of a company's global revenue, giving it real force and prompting businesses around the world to overhaul their data practices to comply.

Because the regulation applied to any organisation handling the data of people in the European Union, regardless of where the organisation was based, its effects were felt globally, as companies worldwide updated their privacy policies, systems and practices, and many extended the protections more broadly.

The regulation reflected growing concern about privacy and the handling of personal data in the digital age, amid mounting unease about the vast troves of information collected by technology companies and the ways that data could be used, shared or exploited.

The law became a influential model, shaping data-protection efforts in other jurisdictions and setting a global benchmark for privacy regulation. Its implementation marked a significant moment in the effort to govern the digital economy and to protect individuals' privacy, establishing new standards and expectations for the handling of personal data and signalling a more assertive approach by regulators to the power of the technology industry over personal information.