The council’s GDPR policy