Mandatory contractual clauses of the GDPR