How to turn GDPR into an opportunity, not a cost