GDPR is not the be all and end all
Any decent Data Protection Officer or GDPR “consultant” should be able to tell you that. If they cannot, then find someone else as quickly as possible because otherwise you are going to spend a lot of money very quickly and find that it is wasted.