A company is planning an AI service for Europe and is researching the regulations that apply. Which regulation strictly governs the handling of personal data within the EU, including the data subject's consent, rights, and cross-border transfers?