The General Data Protection Regulation (GDPR) comes into force on 25 May 2018 and will have important implications for doing business in the European Union (EU). This article highlights some of the GDPR issues most likely to be relevant for Reward, including (a) whether employers need to rely on different grounds for processing personal data than employee consent, (b) greater transparency requirements and (c) enhanced obligations to keep data secure.