Surely, providing the email is not downloaded to the device, there is no GDPR breach. If they download information, and then the device is stolen, that's a potential data breach. Personally, I'm slightly paranoid about data theft, so my hard disks are all encrypted as are any memory sticks and flash drives