[gowld]

Would it suffice to post a popup in your UI, "This website is not certified for the EU. If you are in the EU, you MSUT NOT use this website. Click HERE to certify that you are not in the EU" ? Or are website operators responsible even if unauthorized attackers hack in to their system and leave a "personal data" trail?

[mirko22]

if you do not visibly offer services in EU you dont have to comply to GDPR.

There are few examples in the law of what visibly means, such as having prices in euro or having EU contact numbers...

[StavrosK]

Would having a run-of-the-mill SaaS where users can sign up from wherever mean that you have to comply?

[mirko22]

I would say no, but I am not a lawyer and there are really no precedents for this at current time.