A Framework for GDPR Compliance for Small- and Medium-Sized Enterprises