I'm not sure exactly what GDPR means for the people whose job involves processing data, but I would think that independent of whatever rules apply to the employer as a data controller/processor, 2(2)(c) would except the employee's memory of what they did.