Whenever you collect and process data from consumers, you must ask for their explicit consent where the law requires it, ensure they understand why and how their data is being processed, and put in place adequate measures to safeguard their data.
You need to have a clear, up to date privacy policy on your website that explains what data is collected, for what purposes, who it may be shared with, and what users rights are and how to exercise them. Data processing can include cookie tracking on your website, newsletter signups, account information, and more.