GDPR across a MAT