Why companies must wake up to the challenges of the EU General Data Protection Regulation