Companies think they can skim data like butter, but the law slaps a stop-sign on every crumb. Look: the GDPR isn’t a suggestion, it’s a hard-wired guardrail that forces you to ask “who, why, and how long?” before you even touch a customer’s email address.

Consent – the new currency

Forget “terms and conditions” as a vague blanket. Real consent is a handshake, a clear “yes” that can be pulled back at any moment. If you’re still using pre-ticked boxes, you’re basically robbing a bank with a fake key.

What counts as consent?

It’s a bright, unambiguous opt-in. No fine print, no hidden clauses, just a plain “I agree” that you can record and prove. And yes, you must let the user revoke it with a click, not a maze of redirects.

Data minimisation – cut the fat

Stop hoarding phone numbers you’ll never use. The GDPR demands you keep only what you need, and discard the rest faster than a flash sale. Anything extra is a liability, not a gold mine.

Transparency – speak plain English

Privacy policies should read like a conversation over a cuppa, not a legal textbook. When you explain why you store a cookie, people actually understand and trust you.

Right to access and erasure

Someone asks for their data, you hand it over on a silver platter. They ask to be forgotten, you delete it, period. No excuses, no “we’ll get back to you”. It’s their right, not a favour.

Cross-border transfers – the tightrope

Moving data out of the EU? You need an adequacy decision or Standard Contractual Clauses. Think of it as a passport check for every byte you ship overseas.

Penalties – the sting

Fines can hit 4% of global turnover. That’s not a slap; that’s a full-blown punch that can cripple a business overnight. So, treat GDPR like a fire alarm – you either fix it or you burn.

Actionable step

Audit every data point you hold today, tag it with a purpose, and build a one-click revocation button. That’s the fastest way to dodge a massive fine.