GDPR GUIDANCE FOR GOVERNING BODIES