Assess GDPR compliance for data processing, rights, privacy controls, and incident response obligations.