GDPR - the European Union's new General Data Protection Regulation - comes into force on 25 May 2018