In reply to Otto.

Not so fast Otto, GDPR applies to data collected about EU Data Subjects whether that data is held inside or outside of the EU & EEA (EEA is a wider region than the EU).

An EU Data Subject is anyone who happens to be within the EEA when data is collected. Could be a citizen within an EEA country or a visitor to an EEA country.

A Data Controller must abide by GDPR whenever an EU Data Subject's data is collected, stored and/or processed.

Ultimately, to comply with GDPR, data removal solutions must be applied at server level as well software running atop of the server. There are exemptions for statistical data but rules still apply.

Some light reading.. (the first one has an FAQ):

https://www.itgovernance.eu/blog/en/expert-gdpr-qa-international-transfers-brexit-and-eu-us-privacy-considerations/

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/

https://ec.europa.eu/justice/data-protection/index_en.htm

My cynical mind says:

The stated aim of GDPR is that it will protect the data of EU Data Subjects. I suspect the real aim is a little more sinister: protectionism. GDPR will require businesses that currently store and process data outside of the EEA to move data into the EEA; this will increase demand for data storage and data control services within the EEA.