Every organization that processes personal data must comply with the data protection regulation (GDPR). It applies to companies, associations, organizations, public authorities, and (in some cases) private individuals.