The RSI security site breaks down the methods in some detail, but the method in essence goes similar to this: The GDPR safeguards particular info regardless of the technology used for processing that info. It can be technology neutral and relates to equally automated and manual processing, provided the info https://www.nathanlabsadvisory.com/pci-dss-training.html