Which data protection law is enforced by the European Union?

• A. HIPAA
• B. CCPA
• C. GDPR
• D. FERPA

Answer: (C)

General Data Protection Regulation (GDPR) is the data protection law enforced by the European Union. It governs how personal data of individuals in the EU/EEA can be collected, stored, used, and shared, and it applies to organizations anywhere if they process EU resident data. It establishes a lawful basis for processing, protects data subject rights (such as access, correction, deletion, and portability), imposes security requirements, and requires breach notifications within 72 hours, with substantial penalties for non-compliance. The other laws are U.S.-based: HIPAA covers health information privacy and security, CCPA is California’s consumer privacy law, and FERPA protects student educational records. Since the question asks for the law enforced by the EU, GDPR is the correct choice.