The page you're quoting is specific for public tenders, i. e. selling to governments across the EU. "review procedures" in this context is the ability to appeal

The page you're quoting is specific for public tenders, i. e. selling to governments across the EU. "review procedures" in this context is the ability to appeal those contract decisions. For small companies not engaging in anything specifically nefarious (i.e. Cambridge Analytica) the real danger is really rather limited. If you read https://europa.eu/youreurope/business/dealing-with-customers/data-protection/data-protection-gdpr/index_en.htm https://europa.eu/youreurope/business/dealing-with-customers..., which should take about 10 minutes, you will understand enough about the requirements to stay clear of any danger. One common complaint is that the law isn't very specific. It sets out principles more than checklists. That is unfortunately necessary because it's impossible to anticipate every set of circumstances individually, and because technology is a fast-moving target no specific requirements ("use md5 hashing") could keep up with. Yet if you've understood those principles ("don't collect data you don't need to provide the actual service/product the customer is buying" etc) and strive for the spirit of these rules you shouldn't have any problems.