I have no clue about Purdue, but many large universities with significant numbers of international students have things like recruiting offices abroad, etc.

I have not a deep knowledge of GDPR but wouldn't their study abroad / student exchanges programs with universities from Europe be considered like doing business in Europe?