Who's afraid of the GDPR?