Who said anything about GDPR? If someone reveals to you that they are in some kind of protected class, then there’s a risk that anything you do they don’t like could see you tagged for discrimination even if it’s how you’d treat any customer in the same situation.
If you have evidence it's the usual approach (e.g. written policy documents, aggregate statistics), then it should be fine. If it's a situation that only comes up for certain demographics, and you handle it poorly such that members of those demographics consistently have a worse time than everyone else, then that might be a legitimate discrimination issue even if there's no malice intended.
