In theory, GDPR doesn't change very much in this area. Data subjects already had similar rights to access personal data about them under existing law in much of

In theory, GDPR doesn't change very much in this area. Data subjects already had similar rights to access personal data about them under existing law in much of the EU. The potential fines for non-compliance may be much bigger, though. There is also some expansion in what constitutes personal data under the GDPR, which might be relevant if we're talking about areas where you could have tried to argue they didn't count before but they're going to be explicitly covered in the new scheme.