The road to GDPR compliance