Currently, our team has a number of internal tools that aid the testing and deployment of our products. These are used solely by internal employees, and record actions taken (such as when a file has been viewed).
The recorded data contains identifiable information, such as their Windows username - which can be used to identify a specific individual.
We also process this data, to provide statistics on individual's work, to managers who are also internal.
Does this data, also need to comply with GDPR - or does GDPR only apply to data from the public?