GDPR can enhance or even be a catalyst for a CISO’s policy of ‘protect what matters’, and can offer an ambitious CISO new responsibilities.