20 steps to GDPR compliance