A practical approach to GDPR data discovery programs