Adopted by the European Parliament on April the 14th, 2016, it is effective since May 25th, 2018 and affects all data, whether they were collected before or after this day. In addition, the sanctions for non-respect of this regulation have been hardened: up to 2% of the revenue and 10 million euros (doubled if there is an obvious negligence or damage, in other words up to 4% of the revenue and 20 million euros!)
Some data are self-sufficient. For instance, if you possess a person’s name or their social security number, you can clearly identify them. On the other hand, if you possess data like a postal address or a phone number, these data do not allow you to clearly identify a natural person. Therefore, these data must be paired up for a person to be identify.