GDPR is about putting the customer in control of their data