Forrester interview question

How would I advise a CISO on GDPR