In short: the GDPR is the EU's General Data Protection Regulation (Regulation (EU) 2016/679), which sets how companies and institutions may collect and use your data and what rights you have over it.
Simply put: Personal data is anything by which you can be identified — name, ID number, address, phone, photo, online identifier. A company may collect only what it needs. You have the right to see your data, correct it, ask for erasure, move it elsewhere, object to direct marketing and withdraw consent — as easily as you gave it.
Example: You ask your bank for a copy of the data it holds about you. It must reply within one month (extendable by two more in complex cases).
Watch out: consent is not "a button nobody reads" — it is an agreement about your data and can be withdrawn at any time.
Example: Bulgaria — the supervisory authority is the CPDP (cpdp.bg).
Check in your country — the GDPR applies directly in every EU country; complaints go to your national data protection authority.
Source: Regulation (EU) 2016/679, Articles 4, 5, 7, 12, 15, 17, 20, 21, 77: http://data.europa.eu/eli/reg/2016/679/oj