5 ways to avoid a GDPR fine