GDPR is something completely different.

The cookie law was an email from compliance with something like. 'Oh, and by the way we need a cookie warning. Please fix it.' GDPR begun with mandatory briefings for all employees (not just IT) a year ago and the projects spawned have been going full steam since then.