GDPR is not simple checklist compliance you can just shove onto an irritable HR corporate bureaucrat. Companies can automate up to 70% of processes but now they have to really know the differences between data mapping and data inventory.  They have to mind consumer wishes when it comes to data removal demands.  They have to comply with global regulators or face real penalties. They have to grow and continually improve privacy.