Privacy and data protection have always been a priority policy for the European Union lawmaker. The EU legislations have reach a new milestone with the adoption of the General Data Protection Regulations (GDPR) to protect people residing in European area in terms of personal data processing. This Master thesis is starting from theoretical background and the principals of the GDPR, and investigating the challenges in the implementation of GDPR that brings new obligations to the business life in processing of personal data on a day-to-day work. Furthermore, it is looking at CNH Industrial as a case study, in order to explain the new regulatory obligations that exist between data controller and data processor by close examination of their roles in the GDPR compliance process..