American institutions of higher education with operations in the European Union, or that serve a substantial number of E.U. residents via distance education or other programs, may be subject to a new General Data Protection Regulation. Institutions are advised to review the E.U.’s regulation and, if applicable, begin taking steps to implement these new requirements. For more information, EDUCAUSE has developed a set of key takeaways and answers to pressing questions raised by the new regulation.