Answer: A TRUE
The entire idea of the General Data Protection Regulation is to define the way personal data is collected and managed by organizations. Companies are required to perform Data Protection Impact Assessments to ensure that they comply with the regulation.
For more information on General Data Protection Regulation, please visit the below URL
https://docs.microsoft.com/en-us/microsoft-365/compliance/gdpr?view=o365-worldwide