Harmonisation under the GDPR: the 'one stop shop', territorial reach and sanctions