The European Union's General Data Protection Regulation (GDPR), which took effect in May 2018, grants EU residents several rights regarding their personal data, including the right to access, rectify, and erase their information. Companies that violate the GDPR can face fines of up to 4% of their annual global turnover or €20 million, whichever is greater. The regulation applies not only to organizations based within the EU but also to any entity worldwide that processes the personal data of EU residents. Since its implementation, the GDPR has served as a model for data protection legislation in countries including Brazil, Japan, and South Korea.