I have not a deep knowledge of GDPR but wouldn't their study abroad / student exchanges programs with universities from Europe be considered like doing business in Europe?