GDPR: 12 steps for schools to take