Your explanations are great (thanks for making the effort of writing all of that, really!), though my point wasn't so much that I didn't know the answers (I hav

Your explanations are great (thanks for making the effort of writing all of that, really!), though my point wasn't so much that I didn't know the answers (I have dealt with lawyers over all of this both at work and outside of work, helping friends at other companies, etc), so much that it DOES require explanation. As some people mentioned, it might even differ (significantly!) based on which European country you're dealing with. Things like the legal obligation stuff is still tricky when you deal with american law vs European law conflicting, and even if the law itself wasn't problematic, convincing lawyers can be. You're totally right about the 3rd party vendor thing, and this will get better with time, but it doesn't change much that right now, it's a problem. Even vendors who take security seriously and have awesome engineering teams might have garbage lawyers and you have to deal with them. At the end of the day, no amount of security is perfect and you need DPAs. Getting rid of a vendor over this might be hard. Basically, the whole point is: no, this isn't easy: large companies can have insanely complex problems. Small companies may not have access to the proper lawyer (or even have an IT department!). It's painful. What's worse is having to deal with European laws when you don't have a European presence (foreign lawyers can be tricky or expensive!). And companies who just decide to just avoid dealing with EU customers as a workaround (even small ones who might simply no longer be able to deal with this) get burnt at the stake.