LDAP directories store sensitive personal data: employee records, credentials, contact details. Under GDPR, every byte tied to an identifiable person is subject to strict legal control. You must know where it lives, who can see it, and how long it stays. Missteps equal fines, reputational damage, and loss of trust.