Comment by hermanzegerman

It was their own choice then.

GDPR doesn't require you to perform audits, unlike other Regulations or certifications