While data related to a company doesn't fall under GDPR, the data of the person(s) in that company does.