The European Union’s General Data Protection Regulation (GDPR) creates binding stipulations for corporations who process personally identifiable information, or PII, of EU citizens. US carriers conducting business either in the EU or with EU citizens domestically are considered “data controllers” according to the GDPR and must understand its provisions and how to comply with them.