The EU GDPR is about collecting, storing, and using personal data. But as a side effect, it also concerns the after life of these data. Let's say you throw your computer, and on the hard disk you have files or archives including personal data, then you are at fault, if these data are retrieved by someone else. Same for all kind of documents, electronic or not which is being throw away.

So, you have to destroy the data first. Which in all events is a good practice for anything.

For example, for a hard disk, you should always wipe the surface (even for SSD) with a dedicated software. The wiping is done by rewriting multiple time the whole disk with random data, making the recovering impossible.
(when you delete a file, the system just mark the clusters as available, but the data are still physically present on the disk, until something overwrites it).

This is also to be done, when with your server / hosting plan. Before leaving , you need to delete the data, AND wipe your disk space. The probability is extremely low, but the next person who will get your server next, can retrieve data. When I change server, I always run a file recovery program by curiosity, and each time, I can see mysql databases, with all kind of data ! So wipe your servers / hosting space, before you leave. If someone retrieves the data you collected, you are liable.