GDPR: not as black and white as you might think