That is not true, GDPR is a law, and in the past most EU countries did not have such stringent requirements. You couldn't be sued (Edit: i mean by the DPA).
>>zerost+(OP)
My point is that you won't be sued for the GDPR. What might happen is that a complaint is raised with the regulatory body. This is not the same thing as being sued.