The goal of GDPR is more power and control to people regarding how organizations use their personal data. To be compliant you must have: Privacy principles Data subject rights Lawful basis of processing The concept of privacy and protection by design and default Specific breach notification requirements Information security requirements