GDPR learning by doing (4)