On the 6th of April 2016, the EU adopted a major reform of its data protection framework by adopting a reform package in the area of data protection, which consists of the General Data Protection Regulation, replacing the twenty-year old Directive 95/46 / EC (Data Protection Directive), and the Police Directive. The new EU Data Protection Act, the General Data Protection Regulation (hereinafter referred to as "the Regulation"), is directly applicable from 25th of May 2018, two years after its adoption and ratification. The new Regulation enhances the protection of the individual rights to the protection of personal data, thus transferring the essence of data protection as one of the fundamental rights of the European Union. Since the Regulation will bring a unique set of regulations that will be directly applicable in the Member States' legal jurisdictions, the free flow of personal data between EU Member States will be guaranteed and will increase consumer confidence and security, which are two essential elements for a single digital market. The Regulation will thus provide new opportunities for enterprises, especially for smaller ones, including clarifying rules for international data transfers. This paper highlights the key themes of the General Data Protection Regulation (GDPR) to help organisations understand the new legal framework in the EU. It explains the similarities with the existing Data Protection Act) and describes some of the new and different requirements. Although the new data protection framework is built on existing legislation, its impact will be extensive and will require substantial adjustments in some respects. That is why the Regulation provided for a transitional period of two years - until May 25, 2018 - to allow Member States and stakeholders time to fully prepare for the new legislative framework. Three large parts of the paper - MIS and personal data protection will be described in this paper; where the connection between personal data, MIS and previous practices will be thoroughly described; the second part will be explained by the General Data Protection Regulation and all changes with different interpretations; while in the latter part - Facebook and Cambridge Analytica, the case will be explained and the link with current GDPR rules and practices. The aim of the paper is to provide a clearer interpretation of all changes and paragraphs of the General Regulation on Data Protection and reactions to specific processes within practice.