The two sets of rules to be aware of are General Data Protection Regulation 2016 ("GDPR") and Privacy and Electronic Communications Regulations 2003 ("PECR"), electronic marketing communications.
It is for all people in EU member states, even if the company is not located there. GDPR comes into force May 25, 2018, and as a Regulation does not need member countries to make it law first (though each country will then add it to their own laws). It replaces the Data Protection Act 1998 with the General Data Protection Regulation.
Each country has its own authority, each company must register at one. If you have offices in multiple countries then choose one where your head office and the legal council is located. Otherwise, you will be accountable to each country.
In the UK the organisation is called ICO and their website contains the regulations and many other guides and 12 step programs.