Taming the GDPR beast