Indeed that's how I read it too. It's also worth noting that GDPR is implemented separately in each country so it can in fact differ quite a lot country to country.