A huge change is coming to Europe, and most businesses aren’t ready.

The EU’s General Data Protection Regulation, or GDPR, goes into effect May 25, and with it comes a power shift that allows customers more access to their personal data than ever before.

Customer data has long been thought of as a business asset. However, under GDPR, customers are now taking back ownership of their information and the power that comes with it. They can now choose what information companies have and delete their information from a company’s database for any reason. Companies that don’t comply with the new regulations run the risk of being fined up to millions of dollars.

However, the majority of businesses aren’t prepared for the new legislation. According to Jeff Nicholson, VP CRM of Pegasystems, most companies didn’t realize the impact GDPR would have until it was too late. That leaves companies scrambling to come up with a data solution that meets the guidelines of transparency while also preparing for a potential wave of customer data requests.

A new survey from Pegasystems found that 82% of EU residents plan to use their new rights to view, limit or erase their personal information that companies have on file. That means that not only will companies have to field the requests and share the information they have on each customer, they will also potentially lose customer data if customers request to erase their data. Companies also should handle the request in a way to adds to their customer experience.

Nicholson says it’s more a question of when, not if, the requests will come in. Companies must plan for large numbers of customers asking to see and potentially remove their data. GDPR doesn’t grant exceptions if there are too many requests for a company to handle in time, so all brands must be prepared for large volumes.

Nicholson says the best thing companies can do to be GDPR ready is to be proactive. The power and data shift is coming, and companies that ignore it or don’t plan accordingly run the serious risk of being blindsided by data requests and changes. Being transparent and creating reliable processes for customer data allows proactive brands the chance to build relationships with customers and gain a competitive advantage.

It all comes down to trust and transparency. Customers want to know they can trust companies to take care of their personal information and not sell it or use it inappropriately. Companies that can demonstrate customer trust will be much more successful than unprepared companies inundated with customer deletion requests.

One of the biggest downsides of customers electing to have their data erased is that it can no longer be used for data analytics. Losing data means companies won’t be as connected to customers or have as many insights into their preferences and habits. One of the most vulnerable industries with these changes is retail, which relies heavily on customer data for personalized recommendations and marketing. Companies need to learn to do more with less data to still provide a high-quality, personalized experience.

GDPR is a huge shift in the EU, and it has the potential to expand to other parts of the world, including the U.S. According to Nicholson, the implementation day of May 25 isn’t the finish line but rather the starting line to a long road of customer data changes. Companies that are proactive and GDPR ready will set the tone and can weather the shifting consumer landscape.