GDPR 2 years on: What’s changed?