Is there a GDPR checklist of technical things to do to prevent this from happening to cash-strapped endeavours?