All companies processing personal data must comply with the GDPR, regardless whether payment is charged or not.
Preparing Your Small Business for GDPR Compliance
The General Data Protection Regulation (GDPR) is a European Union law that protects the privacy and personal data of individuals in the EU and EEA.