I'm actually a proponent of GDPR and not a lawyer.

I'm pro consumer protection so I might be biased. On the other hand it's an easy to read legislation https://gdpr-info.eu/