The law you're thinking about is GDPR. It does allow to host data outside of the EU if the rights of the data subjects are not weakened.

Source: GDPR articles 44, 45, and 46.