GDPR is in force – now what?