The General Data Protection Regulation comes into effect on 25 May, offering both challenges and opportunities for brands.