How do you move from subsistence to sustainability in GDPR compliance?