https://pii.ai/articles/navigating-the-gdprs-ropa-requirements