Businesses that want to comply with the new rules should map their data flows, do data protection impact assessments, and upgrade their consent and preference management systems.