GDPR and data: one size does NOT fit all