GDPR is an opt-in kind of regulation as opposed to CCPA wherein the data can be collected only after a user has given their consent. Therefore, while collecting the data, the entity should clearly inform the users how their data is used and processed.