A Structured Approach to GDPR Compliance