Yes, they will probably be the information controller under the DPA and have to be extreamlly careful that our data is safe. Even keeping a copy in a non EU country is very hard.
US companies can store data from EU countries if they comply with the "Safe Harbour" principles. Organisations can self-certify and as yet no company has been challenged as failing to meet the guidelines.