The General Data Protection Regulation has become an integral part of the business, although many small businesses have had difficulties with its implementation due to insufficient information given to the public before the GDPR started to be mandatory on May 25, 2018. GDPR is necessarily for all organizations, both profitable and non-profitable. The implementation phase starts from recognizing the need for implementation, performing GAP analysis, risk assessment, creating the required supporting documentation (forms) and testing and implementation. This paper containes analyses of practices and solutions of the Agency for the Protection of Personal Data (the supervisory authority for the implementation of the GDPR in Croatia). A key research question addressed in this paper is the level of public awarness and the level of security that citizens feel regarding the protection of personal data. The public believes that the use of GDPR is non existing or only fictitious in most businesses, as the research results prove.