As outlined above, simply having a US-based supplier or customer might be enough for a business to be in violation of GDPR. Even if your entire business is off

As outlined above, simply having a US-based supplier or customer might be enough for a business to be in violation of GDPR. Even if your entire business is offline and all your processes are still paper-based (which today would be highly unusual, even in less digitized countries such as Germany, where quite a few businesses actually still rely on paper and - indeed - fax for at least some of their processes), that might still be the case. More realistically, any run-of-the-mill SMB will use at least some digital tools, e.g., for accounting or for running their website. Relying on EU-based suppliers and EU data centres exclusively or even going all the way and storing everything on-premises doesn't necessarily mean you're compliant with GDPR. If only one of those EU-based suppliers has any dealings whatsoever with just one US-based company you're technically in violation of GDPR again.