My understanding is that member states (and perhaps all sovereigns) are not required to comply with GDPR unless they explicitly choose to.