GDPR requires companies to protect personal data. But what exactly does this regulation mean for your organization?