GDPR is the new EU-wide regulation rolling out on 25th May 2018 but so much of the content available online is vague and difficult to understand. You can only collect and use personal information if you have done so according to one of several different options. Some are not available to companies, one, consent is black and white and requires explicit consent whilst another, legitimate interests means deciding yourself whether you have a suitable reason to be able to collect or use personal information.