It challenges rules on how to interpret Main ideas in the GDPR and may difficulty binding selections dealt with to the information defense authorities on dispute in concrete scenarios pertaining to cross-border processing. Your company is service company based outside the EU. It provides services to clients exterior the EU. https://www.nathanlabsadvisory.com/blog/tag/cybersecurity-requirements/