GDPR, or the General Data Protection Regulation, enforceable on May 25, 2018, strengthens data protection provisions for all EU citizens. But the impact of the GDPR goes well beyond EU borders. Companies inside and outside the EU (including suppliers, vendors, and outsourced organizations) that collect, hold, or process data about an EU citizen are required to comply with the law. And penalties are severe–up to 4% of annual global revenue.