12 steps in preparing for the  European General Data Protection Regulation