GDPR compliant by design