The General Data Protection Regulation (“GDPR”) was the product of a revolutionary process of law-making in the European Union (“EU”). The GDPR is designed to accommodate transborder flows of information and to apply equally regardless of jurisdiction. The extra-territorial scope of the GDPR requires countries and organisations outside the EU to understand and even adopt GDPR-compliant processes in order to retain access to EU data. The result is a GDPR that intends and possibly hopes to be de facto adopted worldwide. At the very least, the GDPR will shape and inform advancements in information law for years to come, and become a foundational part of information and privacy law. Anyone processing or controlling EU data will need to be compliant with GDPR obligations.