Compliance with the GDPR requires more than just IT solutions