EU General Data Protection Regulation GDPR is the correct option.

The EU General Data Protection Regulation GDPR is a regulation enacted by the European Union and it is directly binding on all EU member states without needing national laws to implement it.

The EU General Data Protection Regulation GDPR creates enforceable legal obligations for organizations that process personal data of individuals in the EU and it empowers national supervisory authorities to investigate and to impose fines and other penalties for non compliance.

The EU General Data Protection Regulation GDPR also has extraterritorial effect when processing activities monitor individuals in the EU or when goods or services are offered to people in the EU and this gives it legal reach beyond EU borders in many practical cases.

ISO 27002 is an international standard that gives guidance on information security controls and best practices and it is not a statute so it does not by itself create legal obligations unless a regulator or a contract explicitly adopts it.

NIST security publications are authoritative guidance and frameworks produced by a national agency and they help organizations improve security. They do not constitute binding law across multiple countries unless a jurisdiction or contract explicitly requires them.

ISO 27001 is a certifiable management system standard that organizations can be audited against to demonstrate compliance with information security requirements and it is not a binding legal statute unless it has been incorporated into law or contractual obligations.

Full AWS Practitioner Certification Question