EDIT: Am I really being downvoted for requesting a citation to a claim that seems to have no apparent/straight-forward basis in the law? What has this site became?
Chapter 6 of the law is all about the powers of the supervisory authorities, which are tasked with enforcing it.
But this is taken out of article 7 (chapter 2).
But it doesn't say so.
It's implicit. Regulations only mean what ever the regulator decides they mean.
Uh, doesn't the judge judge such things, when company X thinks it's compliant and the regulator thinks it isn't?
In most countries, regulators are given broad authority to issue supplementary rules, explaining exactly what's required or forbidden to comply with the original law. The goal is that people who know a lot about data privacy, rather than random EU representatives, can figure out the specifics.