There are lessons to be learnt from the implementation of GDPR.