I don't think you really understand GDPR if you think that you can just "store" the information and be compliant. It's not only about what data you store. It'

I don't think you really understand GDPR if you think that you can just "store" the information and be compliant. It's not only about what data you store. It's about how the data is stored and who has and can get access to it. The fact that they stored it in excel files is already a big red flag.