If you handle client data, even something as simple as a name and email address, GDPR applies. The same goes for any virtual assistant working on your behalf.