I attended a GDPR session at Re:Invent this year. Basically, there's two types of organizations: data controllers and processors. Datatomic, AWS, Azure, etc.

I attended a GDPR session at Re:Invent this year. Basically, there's two types of organizations: data controllers and processors. Datatomic, AWS, Azure, etc. would all fall into the processors category. Amazon.com, however, would fall into the data controller category. From a processor perspective, they have their own requirements/regulations: https://aws.amazon.com/blogs/security/aws-and-the-general-data-protection-regulation/ https://aws.amazon.com/blogs/security/aws-and-the-general-da... See also: https://aws.amazon.com/compliance/eu-data-protection/ https://aws.amazon.com/compliance/eu-data-protection/ AWS/Datomic doesn't need to know what kind of data their customers store - it's up to the customer to be compliant with their part of GDPR.