Unlocking GDPR: The Devil is in the Details