GDPR compliance and its impact on security and data protection programs