The GDPR, enacted on May 25, 2018, governs how third parties can collect, use, analyze, display, store, retain, transfer, and delete the personal data of EU data subjects, that is, citizens and permanent residents. Protected data includes names, addresses, phone numbers, and email addresses in addition to medical, financial, and other personal details. (For more on the GDPR, see Practice Note, Overview of EU General Data Protection Regulation (W-007-9580).)