Which would be covered by point 3 in my post. Also, the GDPR is not the only law that can have international ramifications.