GDPR in 12 Steps