GDPR covers more than just PII.