Actually right now, since the Schrems II ruling, it doesn't matter where the servers are. The ruling identified that legislation in the US (Cloud Act) is incomp

Actually right now, since the Schrems II ruling, it doesn't matter where the servers are. The ruling identified that legislation in the US (Cloud Act) is incompatible with the principles that would allow data to be transferred absent the "privacy shield" agreement (standard contractual clauses, or binding corporate rules being the 2 main ones). Since the Cloud Act grants access to data hosted overseas, the problem with complying with GDPR is actually now the US legal entity having access or control of the data. Most commentary has focused on the location of the data as key, but in light of the Cloud Act and FISA 702, it comes down to whether or not the data is subject to such laws. On a similar note, many commenters are suggesting if the data is encrypted, that makes it OK. This is true only in limited circumstances (like S3, where you decrypt the data without the US entity seeing the keys). It isn't true where the data is processed by the US entity (absent homomorphic encryption). A lot of misunderstanding around the ruling, but indeed this is the EU saying to the US government, "we are not satisfied your jurisdiction offers protections legally compliant to let your services into our market."