Are physical documents the ultimate GDPR gotcha?