Ten years of the GDPR: your data, your rights

On 24 May 2026, we mark ten years since the General Data Protection Regulation (GDPR) entered into force. This landmark law gave Europeans real control over their personal data for the first time, and changed life online forever.

A landmark for citizens' rights

Before the GDPR, the rules protecting your personal data varied widely from one EU country to another, and your rights were often unclear. The GDPR changed that.

Across the EU, you now have the right to know what data is collected about you, why it is collected, and who it is shared with. You can request access to your data, ask for it to be corrected or deleted, and withdraw your consent at any time.

These rights apply regardless of whether you are dealing with a small local business or a multinational corporation. Companies that have failed to respect the rules have faced significant consequences - including some of the largest fines ever issued against major firms.

A model for countries worldwide

The GDPR is enforced across the EU by data protection authorities in all 27 EU countries, meaning your rights are upheld wherever you are in Europe.

The regulation has inspired similar data protection laws in countries around the world. What started as a European rulebook has since become a global standard, contributing to the growing international recognition of privacy as a fundamental right.

Protecting people in a changing digital landscape

The GDPR does not stand alone. Over the past decade, the EU has built a broad set of digital rules to protect people online:

• The Digital Services Act holds large online platforms accountable for harmful content
• The Digital Markets Act tackles unfair practices by the biggest tech gatekeepers
• The AI Act ensures that AI systems used in Europe respect your rights and safety

Through initiatives such as the action plan on cyberbullying and the European age verification app, we are working to ensure that children can also stay safe online.

Together, these efforts reflect a simple message: in the EU, the online world serves people, not the other way around.

For more information

Your rights under the GDPR

History of the GDPR

Protecting children online

Justice

Digital economy and society