You can store outside of the EU and keep them fully encrypted with encryption keys are only in the EU. Which will make things immensely complicated though. An

You can store outside of the EU and keep them fully encrypted with encryption keys are only in the EU. Which will make things immensely complicated though. And of course, both data at rest and data in transit encryption. GDPR's main point is data protection. Some 3rd world countries stealing idea and converting rules to "turn the data in (decrypted form) so I can see who's doing what".