The aim of the General Data Protection Regulation (GDPR) is to ensure the consistency of the protection of personal data across the European Union (EU). The GDPR imposes new rules that directly affect every Member State. The purpose of this paper is to identify the practical implications of GDPR and to discuss the changes that have the most practical relevance. The situation regarding the collection, processing and use of personal data at the higher education institution (HEI) in Croatia is analyzed with aim of alignment with the provisions of the GDPR. Accordingly, the areas within the HEI that are subject to change are identified, and measures implemented in order to align to the GDPR are presented.with data protection in mind [2]. This principle is called data protection by design, and it is described in the first paragraph of Article 25 GDPR, which states that appropriate technical and organizational measures should be implemented in an effective manner to meet the requirements of GDPR and protect the rights of data subjects. In order to achieve this objective, the data protection principles that are laid down in Article 5 GDPR (lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability) shall be implemented. There are numerous papers dealing with specific provisions of data protection by design contained by GDPR. Related approaches, interpretation of provisions and potential impact on data processing in Europe were presented in [3]. Blix et al. [2] have used a design science research approach to construct a framework for systematic achievement of privacy by design. They presented examples of how the data protection principles can be concretely implemented, thus explicitly tackling privacy by design in systems development. Driven by the introduction of the GDPR, Kurtz et al.[4] conducted a systematic literature review of Privacy by Design approach. The results have shown a surprising lack of research in this field, although GDPR explicitly emphasizes this approach. Authors of the paper [5] have presented the results of the field study regarding the use of privacy impact assessments in practice in the Netherlands, and compared them to the theory and the requirements of the GDPR. Besides legal requirements regarding data protection, social norms and expectations were taken into account. The approach used is Privacy by Design. Another methodology facilitating Privacy by Design approach was proposed by Ahmadian et al. [6]. This methodology supports PIA by performing model-based privacy and security analyses in the early phases of the system development. A framework to model privacy threats was also provided. In order to develop a clear understanding of the existing work and to be able to identify the differences that are invoked by the GDPR, Huth [7] designed somewhat different approach. The approach combines the use of patterns, design theory and the concept of a design theory nexus to propose a process consisting of f...