1 “... to directly applicable exceptions, the GDPR places the regulatory responsibility for further defining how...”