Revise data privacy policy for GDPR compliance