Europe's General Data Protection Regulation (GDPR) is mainly about the following:
#) Tell the user who you are, why you collect the data, for how long, and who receives it.
#) Get a clear consent [when required] before collecting any data.
#) Let users delete their data.
#) Let users know if data breaches occur.
As far as our WordPress plugins are concerned, it never sends any data to any 3rd party (unless you have enabled a 3rd party integration). It mainly stores some transaction data to allow you to run an e-commerce, membership, affiliate business. All the transaction data that is stored in your site can be deleted from the admin interface.
So be transparent in letting them know about the process and take consent from them (the terms and conditions feature lets you do that). So for example, you can add the following section in your terms page to let them know what happens when they buy an item from your site:
---
If you purchase products directly from [YOURSITE], your name, email address and a transaction history will be kept by us. We may use the contact information to inform you about the status of your order, updates, bug fixes. This info is never shared with any 3rd party.
---
Also let them know that they can request deletion of their personal data. The plugin allows you to delete any personal data from the admin interface.