How PCI DSS compliance milestones can be a GDPR measuring stick