The subject of this final paper was the impact of the General Data Protection Regulation (GDPR) on information security policies in the IT sector. It was aimed towards all organizations that are in the phase of implementing the provisions of the GDPR in their daily business activities. The final paper was divided into six thematic chapters. The first chapter was an introduction to the paper in which the relevance of the topic was explained. The second chapter followed with a theoretical approach to personal data protection and GDPR, which presented the conceptual definition of personal data, the history of the development of legal acts that led to the adoption of GDPR, techniques that are used to collect personal data online as well as the potential protection against such practices. The third chapter presented the way of implementing the GDPR in organization's business practices with a focus on internal and external implementation and education of employees about their new responsibilities. The fourth chapter presented the legal framework for preservation of data privacy, an overview of the basic principles of data processing, the Croatian Personal Data Protection Agency as the main regulatory body in the Republic of Croatia that ensures the implementation of GDPR and fulfillment of all rights and obligations in the field of personal data protection and sanctions imposed on violators of the GDPR provisions. In the fifth chapter, two empirical studies were conducted with the aim of confirming or rejecting the hypotheses set. The first survey was aimed at businesses and was conducted using a customized survey questionnaire developed by the German regulator to gather information on the readiness to apply the GDPR in Germany. The second survey questionnaire was intended for individuals, through which an attempt was made to investigate the extent to which respondents were familiar with the extended rights brought to them by the GDPR. This survey questionnaire was drawn up on the basis of a publication designed by the Croatian Personal Data Protection Agency. The sixth chapter was the conclusion in which all the relevant insights, information and facts that were elaborated more extensively during the writing of this final paper were presented in a systematic and concise way followed by a list of literature, pictures, tables, graphs and appendices.