The law about EU data having to be on the servers located in EU already exists.
However there can be weirdness sometimes. I vaguely remember a case where Microsoft had to hand over EU data to a US law enforcement agency due to a court order, but giving that data would violate Irish law. I know there's a new variant of the EU-US Privacy Shield, but with the current US administration that could get ignored very easily.
Which raises the question: can for example Microsoft-the-US-entity in de jure sense cleave off Microsoft-the-EU-entity whilst still maintaining de facto connection between the two? If not, there are definitely big opportunities abound.
What Microsoft might end up doing is following the China model, essentially giving control over their EU servers (probably only those in a special region) to an EU company, while still supplying the software and taking a (very large) cut of the profits.
This is Google + Thales doing the 3rd party operator model, with the operator being a subsidiary of Thales and not Google.
(NB: I work for Google in the EU.)
1. US companies hosting EU data on EU servers are more vulnerable to US Govt demand, not less.
2. US-EU Privacy Shield does not exist anymore.
Like, the conversation will go, "Get us this data"; "EU law says we're not allowed to"; "We don't care, do it or we shut you down."
https://nextcloud.com/blog/eu-court-withdraw-personal-data-o...
Any cloud provider that operates in the US and claims to offer data sovereignty is lying.