[riffraff]

wouldn't any other regulatory body be able to ask that data to check, for example, if they are doing _anything illegal_ with that data?

For example, can't you check for all data to verify that the business is not doing anything with forbidden individuals or countries? (think OFAC)

I don't think GDPR allows anything more than any other law.