As a company, you need to meet the requirements set out in the data protection regulation (GDPR). Among other things, that means following the core principles, making sure all processing of personal data has a legal basis, and informing data subjects about how you process their personal data.