Definition
Regulation (EU) 2016/679 applies to any organisation, wherever it is based, that offers services to people in the EU or monitors their behaviour. Serious breaches can be fined up to 20 million euros or 4% of worldwide annual turnover, whichever is higher.
How it works
Organisations need a legal basis for each use of personal data, must tell people what they do, keep data only as long as needed and protect it. People have rights to access, correct, delete and port their data, and to complain to a data protection authority.
Why it matters
For VPN users, the GDPR matters twice. A VPN provider serving EU customers must handle account and payment data under it. And because the GDPR treats IP addresses as personal data in many cases, websites must have a legal basis to log and use your IP.