To add: The reason why US companies can't be GDPR complaint is because of Article 5 and the conflict with the Cloud Act: https://eur-lex.europa.eu/legal-content

To add: The reason why US companies can't be GDPR complaint is because of Article 5 and the conflict with the Cloud Act: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... (paragraph f) "(1) Personal data shall be: (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)." See also Schrems II: https://en.wikipedia.org/wiki/Max_Schrems#Schrems_II https://en.wikipedia.org/wiki/Max_Schrems#Schrems_II