Data Security on the Ground: Investigating Technical and Legal Requirements under the GDPR