The impact of the GDPR after the first 2 years