Don't beat yourself up! I think the problem is that there is so much FUD and inaccurate groupthink around GDPR issues. Whenever I have spoken to subject matter experts they have pointed out what you did that it actually is not that complicated.

But I guess that the average lawyer knowledgable on GDPR issues would struggle to sort an array even in O(n^2) time so what do they know...

I.e. all things are simple to those that understand them!