The General Data Protection Regulation (GDPR) is a new data governance regulation passed in 2016 to protect EU citizens from privacy and data breaches in a data-driven world. It requires proactive and dramatic change for EU-based companies and has implications that are clearer than in the US and other countries. The regulation was designed to address the challenges of protecting personal data in a hyper-virtualized cloud computing environment, on third-party servers, or in a cybercriminal's underground market listing. Companies must comply with the GDPR and take proactive measures to protect citizen data.