GDPR blueprint