Data breaches inevitably happen. Information gets lost, stolen or otherwise released into the hands of people who were never intended to see it - and those people often have malicious intent. The GDPR (General Data Protection Regulation) is legislation for data protection and privacy of the residents of the European Union (EU) that replaced the previously existing Data Protection Directive 95/46/EC in spring 2018 as the primary law regulating on how companies protect EU citizens’ personal data. Under the terms of GDPR, not only do organisations have to ensure that personal data is gathered legally and under strict conditions, but those who collect and manage it are obliged to protect it from misuse and exploitation, as well as to respect the rights of data owners - or face penalties for not doing so. The GDPR's goal is to impose a uniform data security regulation on all EU members, removing the need for each member state to design their own data protection rules and ensuring that laws are consistent across the EU. The present paper discusses in brief the overview of GDPR, its provisions, penalties for non-compliance and many such queries which we generally have regarding this data protection regulation.