With the entry into force of the General Regulation on Data Protection on 25 May 2018, the company's attitude towards the handling of personal data changed. Businesses face new challenges facing them to bring their business and use of personal data into line with the regulation. The Regulation on Personal Data Protection brings new roles and responsibilities in the process of personal data processing, so previously unknown terms such as Respondent or Subject of Processing, Processing Manager, Processor, and Personal Data Protection Officer had to be implemented in business. Each company collects a different type of personal data depending on the scope of the business, so the information systems implemented in the organization had to be adapted because the previous solutions and design did not meet the rights of the regulation. Based on the Decree on Personal Data Protection in Croatia, the Personal Data Protection Agency was established as a supervisory agency whose goal is to advise, inform, warn entrepreneurs about their rights during implementation and also inform all interested citizens about their rights when processing personal data. The paper presents a study on the application of the Regulation on Personal Data Protection to companies from the public and private sector operating in the area of northwestern Croatia.