Cyber insurance and GDPR fines don't always mix the way policyholders assume. Here's what EU law actually allows insurers to cover.