IANAL, but I do not quite see the relationship between the DSGVO/GDPR and the data format and/or way you access it. AFAIK, a lot of businesses that have to respect the german data protection laws work with other data formats and access mechanisms, like cloud services, on-premise databases, even Excel.
If you’re using the DSM’s authentication methods to limit access to certain documents, they should work for SMB as well as for DSM, Drive Office and everything else on the NAS.