I don’t see how that has anything to do with GDPR. An email is a perfectly fine way to initiate the process. It’s not a gray area