Except on any servers entirely out of EU control. China and Israel for instance, have flatly refused to comply with GDPR and furthermore refute any claimed authority the EU has over anyone or any servers residing in their respective nations. I know I refuse to comply with my small US customer-only physical data storage company even though I regularly get visitors from the EU on my company site (And my site says I specifically only serve US customers mainly because I refuse as an owner to deal with the bullshit surrounding the storage and shipping of encrypted tapes and drives full of data belonging to other people outside of the USA).