It is not true. If you outsource, GDPR applies all the same. And companies had to literally implement changes into their software and literally did.
GDPR applies to data in cloud too.
GDPR applies to data in cloud too.
“Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.”