For private individual usage this should be enough. In the case of business data governance, though, the legal requirements for storage, security, and privacy

For private individual usage this should be enough. In the case of business data governance, though, the legal requirements for storage, security, and privacy go far beyond GDPR. The difficulty there is that even small things such as contact info, appointment locations and dates, timelines, etc. are covered by those contracts.