GDPR is focused on the unauthorized release of Personally Identifiable Information (PII)  outside of your company, or internally in cases of need-to-know.

Timeslips can contain PII, yes.  It is not 'cloud based' so the disclosure would be protected behind Timeslips security, and network security and incumbent on the user to keep on top of that.  Obviously the database is SQL and access to it even through ODBC is again behind a username/password access control.

Sage is a UK based company, and all employees are required to go through a fair amount of GDPR training, regardless of home base.