The technological development of digital devices and the rapid increase in global internet usage has forever changed our lives. Ever since Sweden joined the European Union in 1995 it has been under the person data protection directive (95/46/EG) from the same year. Today, more than two decades later a new international regulation will take its place. This will result in major changes in how companies and organizations must handle personal data. Every company and organization within every country within the European Union must adapt to these changes or risk paying rather fees. Not only does this affect the national laws across a continent and companies like Facebook and Sony on a grand scale - but it also affects the local organizations, small companies, and municipalities. It can be hard to understand what this regulation really means and what should be done to follow it. To do that, the entire work process must be redrawn to provide the best protection possible for the individual citizen. The study shows the work progress of a municipality that is in this position and is in need to adjust its work progress. The study shows how they are adapting to the new changes and are dealing with the problems to be ready when the regulation goes live on May 25th, 2018.