Even if you do not have to comply with GDPR, 12 States have passed data privacy regulations to date. You may still need to comply with data protection law regardless if you qualify for various State laws.
Even if State law doesn't apply - you have have HIPAA, GLBA, SOX etc.
Even if State law doesn't apply - you have have HIPAA, GLBA, SOX etc.