How do you handle developer computers with possible client data on them, even semi-anonymized? Or when communicating issues on the live server, you might transfer client information to other stake holders to debug issue. Are you tracking that communication. Where does the communication data reside, perhaps on a server outside of the EU?
There is a lot of complications that arise if you think about the second order/third order consequences of the law.
There is a lot of complications that arise if you think about the second order/third order consequences of the law.