Lying users about how you process their data could lead to legal action in EU