Trustees are not usually experts in data protection law, so I'd ask the trustees to be providing a lot more information. At a minimum they need to explain: 1)

Trustees are not usually experts in data protection law, so I'd ask the trustees to be providing a lot more information. At a minimum they need to explain: 1) What law they think is being broken (and they need to actually link the specific clause) 2) Why they think G Suite is breaking it (and they need to describe that breach in terms of the law they think is being broken). 3) How much they're prepared to spend on changing from G Suite to something else, including costs of migrating data, checking it's correct after migration, re-training, and any possible software and support costs. G Suite claims it's GDPR compliant. https://cloud.google.com/security/gdpr https://cloud.google.com/security/gdpr