This is a new EU regulation that aims to strengthen individual data protection rights by changing the way companies and public institutions both in and outside of the EU collect and process personal data as well as the legitimate bases for doing it.