GDPR-compliant through role and permission management