Protecting personal data in the cloud:lessons learned after 12 months of GDPR