THE EUROPEAN Union is set to enforce its so-called General Data Protection Regulation (GDPR) law in May next year, leaving Thai companies with European customers vulnerable to potential costly liability on data leaks, according to Forcepoint, a cyber-security firm.