I came here to say this. People should read at least the Wikipedia summary for CLOUD act. It's classic US legislation, 'we don't care about borders when it suits us' style.
GDPR is written the same way.
i.e: https://gdpr.eu/article-3-requirements-of-handling-personal-...
The same way that US sanctions are applied by the US and everyone everywhere should follow them or risk fines and sanctions. No other country does this - when France sanctions Iran, only French citizens and companies are concerned.
"These laws apply outside our borders because the data is stored by our companies"
...are both examples of projection of power beyond borders, just with very slightly different rationale.