Any privacy regulation that could be circumvented by simply transferring the data offshore surely wouldn't be worth the paper it's written on. The GDPR certainly doesn't allow this.