LONDON (AP) — Starting Friday, companies that collect or process the personal information of EU residents must comply with new rules that protect the privacy of people's data.

The rollout of the General Data Protection Regulation has been welcomed but is also causing confusion.

Companies are trying to understand what level of protection different data needs, whether this could force them to change the way they do business and innovate, and how to manage the EU's 28 national data regulators, who enforce the law.

That uncertainty, together with stiff penalties for violating the law, has convinced internet-based businesses such as Unroll.me, an inbox management firm, and gaming company Ragnarok Online to block EU users from their sites. U.S. retailer Pottery Barn said it would no longer ship to EU addresses.