A project manager is leading the rollout of a new customer relationship management (CRM) system for a company that markets products to consumers in the European Union. During planning, the team designs a database that will store customer names, email addresses, and purchase histories. Which regulatory consideration must the project manager ensure is addressed before the system goes live?