GDPR (General Data Protection Regulation) is a European law that protects personal data and privacy for individuals within the EU. It requires websites to handle user data responsibly, including clear consent for data collection and the right to access or delete it.