The new EU directive GDPR, offering greater protection for personal data, takes effect today. Companies must get explicit approval to send unsolicited offers by e-mail and must inform those impacted what personal data they collect. Obsolete data, such as about former employees and clients, must be deleted. Companies must protect the personal data they collect and must report any breach to the personal data protection authority ÚOOÚ within 72 hours. Fines for violation the directive may come to €20m or 4% of annual sales.