Five years on: the legacy of GDPR