GDPR is as much about technology as it is about human processes.