IT security: GDPR do's and dont's