8 steps to comply with GDPR