Four steps closer to GDPR compliance