David Poole wrote a nice summary of the GDPR regulations that come into force this spring in Europe. He covers a number of the sections, trying to provide a simple explanation of the potential issues from the perspective of a data engineer. That's likely the role most of us fill , and I think David does a good job of trying to note the items that he (and maybe you) need to be concerned about. 

If you want to read the full text, and you should, it's here. To me, this is a more sensible, easier to understand type of regulation. It's way better than SOX and most other regulations I've had to deal with, with a better view of balancing the idea that companies won't have all the answers, and might not choose the best technology but do need to make an effort. I don't think this will excuse just continuing to do business as you have, but it does read as though courts and authorities will have flexibility in their interpretation.

One of the main things that should be pointed out is that the 10 million Euro fine is a max, not a minimum. The same things goes for the potential 2% of global turnover (revenue for the US folks). These are the highest potential penalties, though if you have made some effort to protect data and comply, I doubt you'd see fines at this level unless you're negligent. 

The keys parts of this regulation are that companies should be paying more than lip service to data privacy and protection. They should be designing and building software and infrastructure that protects data, and also considers the point of view of the individual or organization that is the subject of the data. That's a good move, in my opinion, having us actually think about the data and the ramifications of its use, sale, transfer, and release, rather than just focusing on our own goals. Most data professionals I know keep this in mind, so GDPR is a step in the right direction to push management to care.

We've got information at the Redgate site, which will help guide you. We are building features into existing and new products, and we'd love to sell you software if you can use it, but we're also learning and trying to share what we know. This goes along with the core values at Redgate of being a part of the community and giving back, through SQLServerCentral, Simple Talk, blogs, and more.

Ultimately no one knows what GDPR will bring, and its application can present a risk to any of us that gather data from EU residents. I know Brent Ozar as already decided to stop EU business for the time being to avoid taking on this risk, and I'm sure other small companies may do the same thing. In one way that's a shame, though a reasonable decision for a company. In another way, this opens opportunities for other businesses. People in Europe still need goods and services, and there are plenty of ways to comply with GDPR that I don't think will be too hard, especially for those businesses based in Europe that won't have a choice. There will be other companies that can fill any void left by companies that cease working in the EU.

GDPR isn't the end of the world. I think it's a good move in the right direction to balancing data value and protections. I'd like to see a better framework in the US that also ensures individuals have rights to exercise some control over all the data being gathered about them, as well as something that forces companies to actually consider data protection in their systems. There may be some bad results from GDPR, but most of us will adapt and continue to do business as we have in the past, albeit with better data controls.