> This applies to you processing the personal data, but not you transferring it to an American provider, which is entirely illegal even if necessary for the ope

> This applies to you processing the personal data, but not you transferring it to an American provider, which is entirely illegal even if necessary for the operation of your service. At worst unlawful, not illegal, but even then, there's subtlety. Most transfers to the US rely on Standard Contractual Clauses, which are being invalidated, but on a case-by-case basis.