Which of the following adopted a law on data protection and privacy for its citizens known as ‘General Data Protection Regulation’ in April 2016 and started implementation of it from 25 th May, 2018 ?

The correct answer is C) The European Union. The General Data Protection Regulation was adopted by the EU in April 2016 and applied from 25 May 2018. It replaced the 1995 Data Protection Directive. As a regulation, it applies directly in all member states without national transposition. Its scope is extraterritorial under Article 3: any organisation processing personal data of people in the EU is covered, wherever the organisation is based. Fines under Article 83 can reach 4% of global annual turnover or EUR 20 million, whichever is higher.

• Australia: Its governing law is the Privacy Act 1988, amended over time, not GDPR.
• Canada: Its private-sector law is PIPEDA (2000). It is a separate framework, not the GDPR.
• USA: It has no comprehensive federal data protection law. It relies on sectoral laws such as HIPAA and COPPA, plus state laws like the California Consumer Privacy Act (2018).

The concept links to the Puttaswamy judgment (2017), which recognised privacy as a fundamental right, and to India's Digital Personal Data Protection Act, 2023. For Mains GS-3, compare the GDPR's rights-based model with India's approach and discuss cross-border data flows.

Trap: Aspirants often pick the US because of its tech giants and data-privacy headlines. The US has no single GDPR-style law.