The EU General Data Protection Regulation (GDPR) comes into force on 25 May 2018 affecting all organisations processing personal data, and bringing new obligations on data controllers and data processors.