GDPR Starts With Your Data, Not With Lawyers