GDPR
EU data protection regulation that sets rights over personal data and imposes global compliance obligations.
On 11 June, Bruegel put public-sector cloud migration linked to GDPR and US jurisdiction at up to €86bn, making data protection a central cost in the EU's technology-sovereignty plans.
Last refreshed: 22 September 2026 · Appears in 1 active topic
Is the GDPR strong enough to prevent US intelligence services accessing EU citizen data?
Timeline for GDPR
Mentioned in: Six states name no AI Act regulator
European Tech SovereigntyMentioned in: AI Act fines land on a stale register
European Tech SovereigntyMentioned in: Omnibus widens the AI Office's reach
European Tech SovereigntyMentioned in: A Spanish court opens the algorithm
AI: Jobs, Power & MoneyMentioned in: Germany names the AI Act's enforcers
AI: Jobs, Power & MoneyBackground
GDPR is the European Union's main law governing the processing of personal data. It gives people rights over their data and requires organisations handling EU residents' data to meet rules on lawful processing, security and accountability, including when the organisation is based outside the EU.
The regulation replaced the 1995 Data Protection Directive and made privacy by design, breach reporting and assessments for high-risk processing central compliance duties. National supervisory authorities enforce it, while the European Data Protection Board helps coordinate the EU-wide system.
Its reach makes GDPR a practical issue in technology procurement as well as legal compliance. On 29 April 2026, Mistral marketed data-residency guarantees for its enterprise product, showing why control over where data is held remains a commercial concern for regulated European buyers.
Its cloud conflict raises costs
On 11 June 2026, Bruegel estimated that moving EU public-sector data under the proposed cloud law could cost up to €86bn. Its analysis treated the clash between GDPR obligations and US CLOUD Act jurisdiction as a reason for reducing reliance on US-headquartered cloud providers.
For GDPR, the estimate shows how a rule written around control of personal data now shapes infrastructure choices. Bruegel also challenged the Commission's assumed 5% cloud price premium, so the eventual cost depends on both the law's scope and the price of European alternatives.
What is the GDPR and who does it apply to?
Why can't US cloud providers guarantee GDPR compliance under the CLOUD Act?
What is the difference between GDPR and UK GDPR?
