You're right Laurent, only thing is when open source (or any kind of software) isn't GDPR compliant then businesses cant procure it. At least not use it in a compliant way.
Mileage may vary of course, but sometimes these things become knock-out criteria in tenders.
But maybe Joplin isnt meant to be procured by businesses.
Side note:
- Something being free doesnt mean it dont needs to be checked against the same requirements a business has during normal procurement.
- When we would procure Joplin Cloud for my organisation all the checks apply, because of the procurement of a service.