One approach to aiding in GDPR compliance is to document aspects of data, permission and data usage for personal data per operational system that contains such information and then to consolidate it - per system - into the CRM.  That is what this first stage does.  For each system, the different aspects are collected and attached automatically to each individual (client).    One task per operational system with a standard series of subtasks.      In production, you would modify/extend these to match the setup within your organization.