GDPR: Regulatory compliance is just the beginning