Data privacy has never been hotter as a topic, in part because the US CLOUD Act came into force, making organizations once again question how their data is managed and who has access to it. In response the Court of Justice of the European Union passed the July 2020 Schrems II judgment, which invalidates the EU-US Privacy Shield, meaning companies cannot transfer personal data to the US any longer. Solving this dilemma when most companies use US-based cloud services is challenging but necessary.