It's implicit. Regulations only mean what ever the regulator decides they mean.

Uh, doesn't the judge judge such things, when company X thinks it's compliant and the regulator thinks it isn't?

In most countries, regulators are given broad authority to issue supplementary rules, explaining exactly what's required or forbidden to comply with the original law. The goal is that people who know a lot about data privacy, rather than random EU representatives, can figure out the specifics.