Under the EU data protection regime, it's already the step where you export personal data to somewhere outside that matters in your scenario. There are obligati

Under the EU data protection regime, it's already the step where you export personal data to somewhere outside that matters in your scenario. There are obligations on those exporting personal data to places beyond the EEA ensure that adequate safeguards are in place to protect it to an equivalent standard. This is somewhat controversial, because arguably it is impossible to meet that standard if you export to somewhere like the US, where there are laws allowing the national government to obtain personal data from those within its own reach, which no contractual safeguards or similar provisions can override. EU nations have similar rules, but only recognise their own national security interests as a valid reason to override the normal protections, not the analogous interests of any third country (that is, country that isn't an EU member state). The UK now has similar concerns in connection with Brexit.