>> that whatever you're doing falls under the GDPR.

Cool, except we weren't confused about that. Figuring out what data exactly and when, along with the proper processes, documentation, and interaction with all of our clients took lots of lawyer time though.