GDPR learning by doing (1)