When i did projects with and for our local university we had clear rules about where which data is allowed to go to. Which mostly ment not using any US services

When i did projects with and for our local university we had clear rules about where which data is allowed to go to. Which mostly ment not using any US services, and choose European services smartly. I still don't get why this kind of data protection is not more common especially for things like education.