"I came to the session with very little knowledge of GDPR and came away with an understanding of the seriousness and responsibility we have with holding people's personal information."