When the business is being conducted outside the EU but the EU is enforcing GDPR, it is a problem. The GDPR is specifically written for extrajurisdictional enforcement which is a big change in the world of laws.

I am just saying that the EU will not be the only jurisdiction following this model. Be prepared.