Building a GDPR-Compliant AI System