General data protection regulation (GDPR) considerations