• It is your responsibility to use GDPR Compliant data processors.
• Regulate who has access to data at your company and keep records of levels of clearance. This way you have documents to present if questioned. 
• Use physical access controls, system access controls, data access controls, transmission controls, input controls, data Backups, and data segregation.
• Anonymise, encrypt, or pseudonymize data where possible as an extra precaution. 

The individual’s right to privacy means that any personal data you collect is not yours to manage freely. 

You must clearly notify data owners that you intend to share their data or process their data if that is your intention.