Cutting through the GDPR jargon