The difference between GDPR and DPA