GDPR & DPA: similar principles