Sure, but SAP's business model doesn't depend on doing as much privacy violation as they can get away with (this is basically the business model of all adtech) so they're far less likely to fall afoul of the GDPR. The main risk to a company like SAP would be _accidentally_ falling afoul of the law; this tends to happen where companies are grossly negligent in their handling of personal data, and this is then exposed in a major leak.