I didn't elaborate because there really isn't any more to say about it. If you've read up on how the GDPR works and know what essential means, you will see this person is correct.

For what it's worth, I have been involved with implementing the GDPR properly in a number of reasonably large companies. Sadly a number of people can say this and a vanishingly small amount of companies actually adhere to it properly, so I'd take it with a grain of salt.