Source: https://law.stackexchange.com/questions/26085/advice-sought-regarding-gdpr-and-managing-sensitive-data