GDPR and data security by design