GDPR Compliant by design