GDPR is not just about "code changes", it includes any entity handling/processing data (marketing, sales, operations,..)- not just code, or the frontend UI.