A Practical Approach to Solving the GDPR Vendor Compliance Puzzle