First off, just presume GDPR applies globally. Then, know your legal 'zones' and by default keep all data in those containers. Thirdly, if you need to send da

First off, just presume GDPR applies globally. Then, know your legal 'zones' and by default keep all data in those containers. Thirdly, if you need to send data from one zone to another, ask "Do I really need to?? really???" and only if the answer is 'yes' do you do a proper design and engage legal and security from the beginning of the project through to the end and on an ongoing basis.