It means that in that case I have to provide my client with a data processing agreement and handle data accordingly.

Basically, it means that what's been best practice all along is made explicit. So, in most case this doesn't affect the actual workflow all that much.

However, in the past occasionally clients could be quite liberal in handing out access to their production data. GDPR definitely has raised awareness that this isn't something to be taken lightly.