I've read a few posts about how this standard is sufficient for GDPR compliance (and other regional regulations, like Brazil's LGPD). Might be useful to the HN crowd.