General data protection regulation (GDPR) is an EU framework setting out the principles for data management by companies who collect it and the rights of the individual providing it. Provisions include the appointment of data protection officers at companies, the need to obtain specific consent to retain the data, notifications of collection and legal consequences if the data is misused.