Surely the issue is harmless, and has nothing to do with the stuff GDPR is legislating against, right? Why not just share a general, fuzzy overview?

I am pretty sure that's what they're asking for. I didn't see a request for specific details. Just some high level details, rather than "we've had to spend so much money/time => clearly bad".