What are some of the major provisions of the GDPR that companies should be aware of?