Considering that gdpr doesnt contain a single technical requirement (in contrast to all food / safety / medical regulations) , typically anyone and anything or nothing can be a violation. Your guess is as good as mine