@nemobis FWIW ‘adequacy decision’ sounds like an odd kind of gatekeeping if the US is included in that list. The UK designed its GDPR implementation while still a member, which is unique amongst those other countries. In my experience it takes GDPR more seriously than some member states. For e.g. the CiviCRM GDPR extension was developed by a UK company, is maintained by another UK company, is used by many 100s of EU non profits and EU Civi agencies today: https://lab.civicrm.org/extensions/gdpr