You don't understand how that works: EU companies are required to act in compliance with the GDPR. This includes all sensitive data that is transfered to busin

You don't understand how that works: EU companies are required to act in compliance with the GDPR. This includes all sensitive data that is transfered to business partners. They must make sure that all partners handle the (sensitive part of the) transfered data in a GDPR compliant way. So: No law is overriden. But in order to do business with EU companies, US companies "must" offer to treat the data accordingly. As a result, this means EU companies can not transfer sensitive data to US companies. (Since the president of the US has in principle the right to order any US company to turn over their data.) But in practice, usually no one cares. Unless someone does and then you might be in trouble.