The GDPR, which replaces the old Data Protection Directive, governs the processing of personal data.
"Processing" includes the collection, organisation, storage, use, consultation, modification, transmission and deletion of data, which may belong to customers, employees or suppliers. This data includes, among other things, customer transaction information, contact details, passport copies, etc.
Consumers have more transparency and control since they are better informed of when and why companies are processing their data and can exercise their individual rights on the basis of this more complete information.