Replying to @null and @SimonDeDeo, @matthewstoller, @joftius
GDPR really isn't checklist compliance so I'm really playing judge/regulator here but: the facts matter most. If the software presents no risks to the rights and freedoms of data subjects you're OK no matter what whoever says.