The General Data Protection Regulation is the toughest privacy and security law in the world and imposes obligations for organisations anywhere, if they target or collect data related to people in the EU.