This GDPR article presents the situation nicely. It explains most companies have people data of some sorts, emails, some have even gained 3rd party data to "slice and dice" and segment.
GDPR means that you and I as consumers can ask to see what data is being held and have it deleted. Simple as that.
So if you "provoke" people with cold calling, cold emails, poor quality customer service, they may well invoke these requests. In recent research 82% of European consumers will invoke these requests and the fines? 4% of worldwide turnover. Ouch!
I know I will be doing it and so will many other, better get ready!
As a footnote, as a CEO of a company that needs to be GDPR compliant I underestimated how long it will take and we are a very small company. We will be ready by the end of January.
The survey revealed that poor brand experiences are among the top five triggers most likely to spur people to use their GDPR rights and ask companies to delete their data. Poor brand experiences include robocalls for irrelevant products or services, poor customer service, and being contacted by companies too frequently and in intrusive ways.
https://www.cmswire.com/digital-experience/what-the-gdpr-will-mean-for-your-bottom-line/