I wouldn't be shocked at all. Internal tools are never as streamlined as you would think. On top of that, the tools for doing this are probably not that mature

I wouldn't be shocked at all. Internal tools are never as streamlined as you would think. On top of that, the tools for doing this are probably not that mature given that GDPR hasn't been around that long, nor do a majority of users take advantage of it.