The EU GDPR only allows companies to store and process personal data under certain conditions. This requirement reinforces the rights of EU citizens — and is enforced by way of tough sanctions on violations. As a company, you need to be fully aware of which requirements apply to you and the consequences of a breach.