Companies that collect personal data of E.U. citizens must comply with new rules to protect privacy, starting in May. Even U.S. companies may be affected.