> It's not like the enforcers could walk into the datacenter and plug in the usb drive and get the data. They can ask and/or force a given company to hand data

> It's not like the enforcers could walk into the datacenter and plug in the usb drive and get the data. They can ask and/or force a given company to hand data to them in many cases in most jurisdictions. > Does logging constitute user data. Logging of user-data? yes > A much saner approach should be limiting what the company is allowed to do with the data. GDPR does also regulate what a company is allowed to do with data. The thing is: whether the GDPR applies and is enforceable depends on where that data is stored.