This chapter provides a critical account of the substantive content of the GDPR. Particular emphasis is put on the concepts of personal data, data controller/processor and consent. New user rights including the co-called right to be forgotten, the alleged "right to an explanation" and data portability are also interrogated. Important adjunct issues such as territorial and material scope, privacy by design, enforcement and data exports are also explored.