This GDPR article presents the situation nicely.  It explains most companies have people data of some sorts, emails, some have even gained 3rd party data to "slice and dice" and segment.

GDPR means that you and I as consumers can ask to see what data is being held and have it deleted.  Simple as that.

So if you "provoke" people with cold calling, cold emails, poor quality customer service, they may well invoke these requests.  In recent research 82% of European consumers will invoke these requests and the fines? 4% of worldwide turnover.  Ouch!

I know I will be doing it and so will many other, better get ready!

As a footnote, as a CEO of a company that needs to be GDPR compliant I underestimated how long it will take and we are a very small company.  We will be ready by the end of January.