GDPR learning by doing (7)