Forms Report GDPR Compliant?

If you go to Home>Activity>forms getting submits and click on one of the form reports, you can download the form's entire data submission history, even if you are only a sales user. This download is full of personal information. If you've assigned sales user accounts to outside sales reps or agents, they can easily access this download and suddenly you've lost control of your data and its in the hands of another company. This seems like a GDPR compliance breach. In addition, if a user requests to be forgotten, are they automatically purged from the form submission data too? Any input?

------------------------------
Jackson McKay
ADVANCED Motion Controls
------------------------------