The announcement of the entry into force of the General Data Protection Regulation. abbreviated GDPR., has greatly changed the company's business focus, in terms of personal data protection. Attention has been paid to the personal data of all citizens of the European Union, and the announcement of high penalties caused a negative public reaction. Companies face new ways of understanding the definition of personal information and their business systems need to adapt to be able to meet the new demands that GDPR delivers. GDPR also introduces new roles and responsibilities in the processing of personal data, so we meet with terms such as the Data Subject, the Data Controller, the Data Processor, and the Data Protection Officer. Each company is different in terms of business and collecting personal data of respondents and the use of business systems that need to be adjusted. Most of the earlier programming solutions were not designed to support requirements such as right to access, right to be forgotten, and right to data portability. The idea of this graduate thesis is to present the novelties that come with the entry of the GDPR into force, and the ways in which companies need to be harmonized to be able to meet all the requirements of the respondents. During the work I described some possible solutions to the company's compliance with GDPR requirements and, as part of the internal project in the company I worked on, analyzed the current state, risk and data security plan. The paper is written in a way that it can serve as a guide to the implementation of GDPR in any company.