One of the largest changes to data protection laws in over two decades, the General Data Protection Regulation (GDPR) applies to any company that does business with a European Union (EU) member state that involves the personal data of an EU citizen. Compliance is required of any entity doing business, either directly or through affiliates, which involves the collection, processing, or transfer of personal data of citizens in the thirty-one countries in the European Economic Area (EEA). Operations in ecommerce are included. Through GDPR, the EU hopes to give people more control over how their personal data is used and ultimately lead to more trust in the emerging digital economy.