GDPR: 6 years in, where do we stand?