It's not "a potential issue in the UK" it's an issue across the EU - they were pointing out it's also an issue in the UK even though we've left the EU.

GDPR is not a new or surprising thing, and the absolute basics should be known by any developers working with private data. It's frankly shocking if they didn't know while starting a company in the UK, and I don't know if it's worse if they didn't know or didn't care.

This is a business that it will be vital that they are following regulations, and if they're skipping this, why should I trust they're following the rest?