It's basically the same with the GDPR, it talks more about principles than companies or technologies to be able to adapt to a fast changing field - which I appreciate as a citizen but as an implementor I prefer the checklists of PCIDSS which are not vague.