Exactly, GDPR is only asking for Security 101 Basics.

* Data Classifications

* Privacy Impact Assessments

* Log Reviews

* Incident Reponse