They don't own the bits. They own the data those bits represent. The person/company who does own the bits has to comply with the rights of the owner of the data.
How you decide to store it makes little difference as long as it's digital.
Fun aside: if you store it on paper you're not beholden to GDPR. Crazy.