Right, so that's the big part of GDPR that, as far as I know, osquery can't really help with - specifically, controls around how PII data is stored and retrieved at the application level. osquery can't really look inside databases (mysql or otherwise), or, in general, any proprietary application (consider password protected excel spreadsheets, screenshots in JPG files, etc.)