The Workspace in Affinity is a shared environment that is secured within the user’s account and therefore benefits from all the standard security measures implemented to protect user data.
I don’t believe there is anything within GDPR that mandates that you cannot send documents by email, although Affinity Workspaces don’t allow documents to be emailed and requires the end user to login to upload or access files.
I hope that helps, but please let me know if there’s anything I’ve missed.