Consent is insufficient. Exclusively storing data on servers physically located in the EU is insufficient. As soon as a business has dealings with a US-based co

Consent is insufficient. Exclusively storing data on servers physically located in the EU is insufficient. As soon as a business has dealings with a US-based company or an EU-based company owned by a US-based company that potentially might have access to user data that business technically is in violation of GDPR. As of now, as a business you essentially have three alternatives: 1. Run the entire infrastructure you need yourself or have it run by EU-based companies guaranteed to have no relations with US-based entities whatsoever (Good luck with finding those ...). This, for example, includes payment systems and banking infrastructure, because guess where many EU-based banks host their infrastructure? That's right, AWS. 2. Go out of business. 3. Ignore this aspect of GDPR for now, document everything, continue to do your own due diligence, and hope for the best.