What is GDPR?
Tough new data protection laws come into effect on Friday that promise to bolster consumer rights.
But there are concerns that many firms have not done enough to prepare for the new rules, known as GDPR.
Big fines could be imposed on companies that "persistently, deliberately or negligently flout the regulations", the UK's data watchdog says.
But it told small businesses there is no need to panic and that it is "here to help".
What is GDPR?
The General Data Protection Regulation (GDPR) applies to all organizations that handle European Union citizens' data.
The rules give consumers new rights, including rights to find out what data is being held on them, and to delete that information, unless a firm has a good reason to keep it.
Companies now have to get consumers' explicit consent to use personal information, and getting people to give more personal information in exchange for a premium service is not allowed.
Firms also have to meet higher standards for keeping data safe.
Many firms have been sending out emails asking people to renew their consent to receive marketing.
Are the rules good news for consumers?
Definitely, says the Which? consumer rights group.
"GDPR will strengthen your personal data rights, including the way companies handle your data and redress for misuse of that data," says Which? consumer rights expert Adam French.
"Companies will need to tell you exactly what you're signing up for and you will have more control when it comes to opting out of future communications.
"You will also have more opportunities to make a claim for damage caused by the misuse of your data," he says.
Ailidh Callander, legal officer for campaign group Privacy International, says the new rules have "been a long time coming".
"GDPR is an important step in the right direction," she says.
Why are companies concerned?
The penalties for wrongdoing could be quite hefty, especially for big companies.
The new rules give the Information Commissioner's Office (ICO) powers to fine firms up to €20m (£17.5m) or 4% of global annual turnover for serious breaches.
Many smaller firms may not be prepared for the regulations coming into force, business body the Federation of Small Businesses (FSB) says.
"GDPR is here and the likelihood is that many of the UK's 5.7 million smaller businesses will not be compliant," chairman Mike Cherry said.
He says the "burden and scale" of the reforms have proven too much to handle for some.
And he says many small firms fear the ICO will be heavy handed in dealing with non-compliance, "slapping" them with fines.
What does the watchdog say?
The ICO says firms can trust it to act fairly.
"We pride ourselves on being a fair and proportionate regulator and this will continue under the GDPR," says Information Commissioner Elizabeth Denhams.
"Those who self-report, who engage with us to resolve issues and who can demonstrate effective accountability arrangements can expect this to be taken into account when we consider any regulatory action."
She acknowledges there will be no grace period for businessesthe rules will be fully enforced from 25 May.
However, she says firms have had two years to prepare.
Are all businesses worried?
Business body the CBI says many firms are prepared for the new rules.
"You only need to look at your inbox to see businesses up and down the country are stepping up to make sure people are aware of their privacy policies," a CBI spokeswoman said.
But firms that aren't compliant "need to get their action plan sorted quickly".
The ICO is ready to help, and businesses should also consider getting external legal advice, the spokeswoman said.
"GDPR marks a watershed moment in how businesses deal with people's data," she said.
"How firms act with personal data goes right to the very core of trust in business.