Physical security – locking down GDPR compliance