From 25 May, the GDPR will make more people liable for financial penalties if they mishandle customers' personal data.