Organisations must comply with privacy laws such as the AVG by obtaining consent for data collection, ensuring data protection, and implementing processes for deleting data at the request of employees.