I don’t think the GDPR is as difficult as you suggest. The biggest problem companies seem to struggle with is this idea that the personal data they keep isn’t theirs and they need to protect it like anything else in their possession that isn’t theirs.
You keep writing things like this, and I'm not going to just post the same reply every time, so let's try another one here.
Let us assume for the sake of debate that Privacy Shield will at some point be struck down by the courts, like Safe Harbor before it, since the fundamental objections involving US government access have not changed.
At that point, please explain the conditions under which an EU business can share PII with a US business without violating the GDPR.