https://iapp.org/news/a/article-29-working-party-lays-out-gdpr-action-plan/