Please note that the PBX as a product does not require significant changes. In fact the only data the PBX currently sends out is the licence details for the activation of the PBX. All other data are kept by the administrator of the system and it is their responsibility to notify users to the fact that personal data is kept (reports, recordings, emails. reports etc). From our side by the end of the deadline we plan to release an update and implement the minor changes required like disclaimers regarding licence details or support files required for troubleshooting.
Thanks for your response @YiannisH_3CX but i have one more question.
in a example configuration i host the VoIP PBX servers as VM's for the customers here at my building, the customers make connection through the 3CX SBC on a raspberry pi.
As far as the SBC goes this was answered in an earlier post here.
As far as PBX goes the same facts apply as my answer above. Now if you are hosting i believe that other regulation may apply. A quick google search will provide more answers regarding than i can provide.