Personal data protection is a global issue. The EU has adopted strict legislation, which applies not only to companies with a seat in the EU, but also to all those who offer goods or services in the EU and process its citizens' personal data while doing so. For a number of companies, GDPR presents considerable risks: potential sanctions by supervisory authorities and also an underestimation of the regulation's impact on the companies' internal processes or contractual relations. On the other hand, GDPR is an excellent opportunity to gain a competitive advantage and clients' trust.