I have s feeling GDPR is often used as an excuse in these cases while there is little evidence that it's actually slowing anything down. Especially for government: they do have the data alread and the GDPR applies to the dat itself, not whether you put a fancy frontend on it or not.

Government departments tend to be slow to adopt - again, based on feeling more than hard evidence - especially emin Germany. They'll just try to find some scapegoat for why they're failing, and GDPR is perfect. I've seen the same in businesses as well, where I've seen told numerous times they're behind schedule because of GDPR or they can't do this because of GDPR and it's just not true most of the time. People just like to hide their incompetence

I don't know anything about EVB-IT, so I'll shut up about that part

I know about EVB-IT and GDPR. And it is actually slowing down a lot. While each of these things can be managed the combination is a productive killer. You will understand this if you ever worked as a it-project manager in the German goverment. There is a representative for everything and he is just doing his part and blocking everything not in his work field. It is not something like GDPR alone but the combination and the handling of these aspects. And law aspects always get the highest proirority.