GDPR, short for General Data Protection Regulation, is a privacy regulation passed by the European Union (EU) that oversees how companies, websites, internet providers, and other web-based services collect, manage, and use user information. However, its laws stretch far beyond the EU as it governs how organizations handle data related to EU residents, regardless of where the organizations themselves are based.