GDPR provides data subjects with a wide range of rights that can be enforced against enterprises that process personal data. These rights will limit the ability of enterprises to lawfully process the personal data of data subjects in many of the ways that were regularly employed in the past. These new rights can significantly impact an enterprise's business model. The shift to a protection model that is focused on individual privacy represents a major transformation in the requirements for protecting the personal data of individuals throughout Europe.