The GDPR doesn’t care where the personal data is stored, I thought. It makes no distinction as far as I can tell between data stored on a web server and data st

The GDPR doesn’t care where the personal data is stored, I thought. It makes no distinction as far as I can tell between data stored on a web server and data stored on a device. You seem to be making a distinction. Is there a source you could reference?