This is what the GDPR requires.