Removing the guesswork from GDPR