GDPR
The EU General Data Protection Regulation requires a lawful basis and purpose limits for personal data, and sets out people's rights over it.
Definitions only — a term explained here is not a service we sell.
The GDPR governs personal data for people in the EU. Personal data needs a lawful basis, a stated purpose and a retention period. Consent is one basis, not the only one: contract performance and legal obligation can also apply.
People have rights of access, rectification, erasure, restriction, portability and objection. Requests must be answered within the regulation's deadline, so data has to be findable across systems, including logs and backups.
Scope and lawful basis
The regulation can apply outside the EU, when an organization offers goods or services to people in the EU or monitors their behavior. The location of the company is not the only test.
Marketing messages usually rest on consent. Consent must be specific, informed and revocable. This is general information, not legal advice; scope obligations with counsel.