Ensure that your web application only uses native features and services of Google Cloud Platform, because Google already has various certifications and provides pass-on compliance when you use native features.

Enable the relevant GDPR compliance setting within the GCPConsole for each of the services in use within your application.

Ensure that Cloud Security Scanner is part of your test planning strategy in order to pick up any compliance gaps.

Define a design for the security of data in your web application that meets GDPR requirements.