A European Union law that governs how businesses collect and use personal data.