GDPR
The EU law saying you need a legal reason to hold someone's personal data, and they can demand to see, correct, or delete it.
See it
What it is
In force since May 2018, GDPR governs personal data about people in the EU and EEA, and its reach is not decided by where your office is. You are in scope if you have an establishment there, if you deliberately offer goods or services to people there, or if you monitor their behaviour. A two-person startup in Bangalore that prices in euros and ships to Berlin is in scope; one that happens to get a stray visitor from Berlin is not. Its engine is the lawful basis. Before you process anything you pick one of six justifications (consent, contract, legal obligation, vital interests, public task, legitimate interests), write it down, and stick to it. Around that sit data subject rights (access, correction, erasure, portability, objection), the controller and processor split with signed DPAs down the vendor chain, breach notification to the regulator within 72 hours whenever the breach is likely to risk people's rights and freedoms, and transfer rules like SCCs for sending data outside the EEA. Fines top out at 20 million euro or 4 percent of worldwide annual turnover, whichever is larger.
The practical starting move is a data map: every place personal data enters, every system it sits in, every vendor it reaches, and why. Most of the paperwork (records of processing, retention schedule, privacy policy, subprocessor list) falls out of that one document, and you cannot honor a deletion request without it.
Gotcha: GDPR is not 'the cookie law'. The banner requirement comes from the ePrivacy Directive; GDPR only sets the quality bar for what counts as consent. Related misconception: relying on consent for everything is usually the wrong pick, because consent must be freely given, granular, and withdrawable, so running a paid product on it means the account breaks the moment someone says no. Contract covers the processing that is objectively necessary to deliver what the user signed up for, and legitimate interests covers a fair amount of the rest if you can show necessity and survive a balancing test. Neither is a dumping ground for whatever consent would not buy you. Finally, the UK now has its own near-identical UK GDPR, so 'EU and UK' is two regimes, not one.
Ask AI for it
Audit the product described below against GDPR and return a gap list, not an essay. Produce: a data map table of every personal data field with where it is collected, which systems and vendors it reaches, the proposed lawful basis, and a retention period; a list of missing artifacts (privacy policy sections, records of processing, subprocessor list, DPAs to sign, retention schedule); the engineering work needed to serve access, export, correction, and deletion requests, including which tables and which vendor APIs each one has to touch; a breach response path that assesses risk fast and hits the 72-hour window whenever notification is required; and any transfer outside the EEA with the mechanism it needs. Rank everything by risk against effort, and flag where consent is the wrong lawful basis, showing the necessity or balancing reasoning if you propose contract or legitimate interests instead rather than just asserting the swap.