The General Data Protection Regulation, or GDPR. It may be the new kid on the cybersecurity block, but that doesn’t mean it’s something you can ignore.

Effective in May of 2018, the regulation marks a colossal shift in the treatment and handling of personal data. And while the GDPR is an EU policy, its effects aren’t limited to European borders.

On top of the implications the policy has on global companies with ties to the European market, the GDPR also marks a significant political move in data security, one that forces data controllers and processors to be more transparent about—and held accountable for—the data they collect and use.