Mostly because - for understandable reasons - the EU parliamant kept GDPR vague on implementations.

I've implemented PCIDSS and SOX several times which was much easier, because there is implemantation documentation and everyone knows what to do.