The General Data Protection Regulation (GDPR) has been approved by the European Union and, once it comes into force in May 2018, will give data subjects significant new rights over how their personal data is collected, processed, and transferred by data controllers and processors. It demands significant data protection safeguards to be implemented by organizations. The time to get ready is now, as the consequences of getting it wrong are significant.