The whole situation is confusing for me. We set up a few project with kubernetes clusters for local governments in the Netherlands. They denied DigitalOcean because even though they have servers in Amsterdam, the company is in the US, so we went with a much higher priced custom K8s cluster from a local provider.

So not really sure if they were right, but according to them even just having your servers run by a US company is a potential legal risk with GDPR.

But at the same time other departments in the same organization run on Azure.