Yes, except the government has, in its majestic fairness, carved out exceptions in gdpr for government entities.