Law and the GDPR