From what I understand, as long as you can say there's a process in place (and could actually follow it) then you're compliant with the GDPR.