When merchants indicator a deal that has a payment processor, they agree to be subject to fines when they are unsuccessful to maintain PCI DSS compliance. The GDPR protects own information whatever the technology used for processing that data. It is technology neutral and applies to each automated and guide https://www.nathanlabsadvisory.com/blog/nathan/achieve-pci-dss-compliance-in-the-usa-secure-your-business-today/