Comment by gmueckl

Ever since the Peace of Westphalia, the international law is that each country sets its own laws for its own territory. Country A cannot enact a law that is effect on the territory of country B. So if the data is physically stored in the EU, it is naturally subject to the GDPR and no law outside the EU can do a damn about that. The CLOUD act, on the other hand, breaks that principle: it tries to compel actors outside the territory of the US to comply with US law.