What are all these GDPR emails filling up your inbox?

‘Hey there Field Left Blank. So listen, budski, my man, my main man ... I know we’ve been sending you spammy emails about cheap holiday deals five days a week. For the last five years. Yeah, maybe we took a few liberties with that. Mistakes were made. IDK. But I’m here, today, to tell you we value you as a customer, Field Left Blank. So .... um, was wondering, would you be interested in maybe opting in? Please. Please?”

So goes every third email in your inbox this week, as a change in the law heads towards its final 24 May deadline, with even such well-established email beggars as the Guardian getting in on the act. But what exactly is GDPR?

The General Data Protection Regulation (GDPR) is the EU’s biggest personal data shake-up since 1995. And the US tech giants are not exempt, which is why Facebook quietly decided to move 70% of its global users’ data back from its Irish headquarters to the US, outside the reach of GDPR.

The regulation has been billed as a gamechanger in rebalancing consumer rights. The emails are the front door to that. Companies that have an “existing relationship” and valid consent with you might not need to reaffirm consent (there’s a measure of grey here), but all those half-dormant relationships are about to get a massive spring clean. Click the opt-in button, or hear only silence, for ever. With opt-in rates apparently running at about 10%, many companies are resorting to prizes or draws to incentivise those consumer clicks.

From 25 May, pre-ticked boxes can no longer be used to indicate consent to a company’s terms and conditions. Plus, a request for consent cannot be buried under pages and pages of terms. You can request a copy of any personal information held, and you can ask a company to delete all the data they have on you.

The law also promises users “data portability”, which is designed to force operators to allow you to take your old data to the new company you prefer, preventing lock-in. If it works (many are sceptical), it could hugely boost competition, loosening the vast data monopolies of the big players. After a phase of hacks against everyone from LinkedIn to Ashley Madison, regulators have demanded “pseudonymisation” or “tokenisation” of user accounts. Meaning that even if user data leaks, it shouldn’t be personally identifiable.

It might be good for the consumer, but businesses are already grumbling about the cost of enforcement, with companies of more than 250 employees required to hire a data protection officer. That may prove to be money well spent. The maximum fine for non-compliance with the new rules is €20m (it was £500,000 under the old system) or 4% of annual global turnover – whichever is bigger.