Write down GDPR designs and considerations for service roles

How to handle data retention, GDPR compliance and processes, yada yada. There should be a concept for that.