All companies processing personal data must comply with the GDPR, regardless whether payment is charged or not.

What Is a DPO? Understanding the Role and Its Importance in GDPR Compliance
The General Data Protection Regulation (GDPR) establishes the requirement for certain organizations to appoint a Data Protection Officer (DPO). The role of the DPO is