The new data protection regulation imposed strict requirements on how personal information can be collected and used.

Data protection authorities have the power to fine organisations that mishandle personal data.