OK. Now let's see the requirements ...

As I already said, the goal of GDPR is to protect user’s personally identifying information.

Which includes: name, emails, physical address, IP address, health information, income, cultural profile, online identifier, etc.

And here are the most important ideas ...

Explicit consent

When you are collecting some sort of personal data from an EU resident, you must obtain an explicit, specific and unambiguous consent.

For it to be considered explicit consent, you must require a positive opt-in (pre-ticked checkboxes are NOT allowed!), contain clear wording (no legalese), and be separate from other terms & conditions.

Rights to data

You must inform your visitors where, why, and how their data is processed and stored.

An individual has the right to download their personal data. More than that, an individual has the right to be forgotten meaning they can ask for their data to be deleted. This will make sure that when you hit the "Unsubscribe" link, or ask companies to delete your profile, then they actually do that. Or at least that's the goal ...

Breach notification

Also, organizations must report certain types of data breaches to relevant authorities within 72 hours, unless the breach is considered harmless and poses no risk to individual data. However if a breach is high-risk, then the company MUST also inform individuals who’re impacted right away.

To put it simple, GDPR makes sure that:

• businesses can’t go around spamming people by sending emails they didn’t ask for

• businesses can’t sell people’s data without their explicit consent

• businesses have to delete user’s account and unsubscribe them from email lists if the user ask you to do that

• businesses have to report data breaches and overall be better about data protection.

Nice theory isn't it?