That seems like checkbox-compliance theater. Also doesn't seem to be supported by official findings. There are notions that actually you cannot be fully GDPR compliant with Microsoft 365. [0] Therefore state organizations sometimes do migrate to different offerings. [1]
>Therefore state organizations sometimes do migrate to different offerings
And then come back to Mother Microsoft. See Munich.