How would they respond to a GDPR request?