The GDPR explicitly does not set out to specify implementation details because of the reasons here: https://gdpr-info.eu/recitals/no-15/ (Technology neutrality)