The impact of GDPR after the first 12 months