PCI-DSS is essentially about credit/debit card data. GDPR is about personal information is general, such that you need to let your users know what you are collecting, what you will do with it, and how long you will hold it.