GDPR and getting to grips with your database