GDPR deals with processing of personal data, not just collection or canonical records of it. If personal data passes through a system, it’s probably covered by GDPR.