GDPR (General Data Protection Regulation)is alegal frameworkenforced by the European Union to protect personal data and privacy. Unlike internal organizational policies such as AUPs or codes of conduct, GDPR is alegislated regulation, and organizations must comply or face legal consequences. Reference:Section 4.1 - Basic Network Security Concepts - "GDPR and Compliance Regulations"