Which statement about the General Data Protection Regulation (GDPR) is true?

Which statement about the General Data Protection Regulation (GDPR) is true?

• A. It enhances protection of EU citizens and increases obligations for companies that process personal information.
• B. It applies only to EU-based companies.
• C. It eliminates the right to access personal data.
• D. It has no penalties for violations.

Answer: (A)

GDPR strengthens data protection for individuals in the EU and increases the responsibilities of any organization that processes their personal data. The statement is true because it broadens both the rights of data subjects and the obligations of those who handle data. It gives people stronger rights—such as access to their data, correction, deletion, and portability—and requires organizations to have a solid lawful basis for processing, obtain clear consent when needed, and implement security measures. It also expands the regulation’s reach beyond EU borders: any company anywhere that processes the data of EU residents must comply, not just EU-based companies. And when rules aren’t followed, GDPR enforces penalties with substantial fines. The other statements don’t fit: it does not apply only to EU-based companies, it does not eliminate the right to access data, and there are penalties for violations.

GDPR strengthens data protection for individuals in the EU and increases the responsibilities of any organization that processes their personal data. The statement is true because it broadens both the rights of data subjects and the obligations of those who handle data. It gives people stronger rights—such as access to their data, correction, deletion, and portability—and requires organizations to have a solid lawful basis for processing, obtain clear consent when needed, and implement security measures. It also expands the regulation’s reach beyond EU borders: any company anywhere that processes the data of EU residents must comply, not just EU-based companies. And when rules aren’t followed, GDPR enforces penalties with substantial fines.

The other statements don’t fit: it does not apply only to EU-based companies, it does not eliminate the right to access data, and there are penalties for violations.