In Spring 2018 the General Data Protection Regulation (GDPR) will replace the Data Protection Directive 95/46/ec as the primary law regulating how companies protect EU citizens' personal data. Companies that fail to achieve GDPR compliance before the deadline will be subject to strong penalties. Even with the UK’s decision to leave the EU, UK companies are still required to protect EU consumers data per the new directive.